1

I am currently studying CSRF and DNS Rebinding attacks and I am wondering what the exact difference is. As far as I understand, DNS rebinding is way to bypass CORS and thus get information from a service that listens on localhost that an attacker would not get otherwise. CSRF however only allows an attacker to trick the user into performing a certain actions on a service that listens on localhost, but would not allow for any information extraction (because that would be prevented by CORS). Is that correct?

Also, what are protection mechanism to prevent CSRF vs DNS rebinding? CSRF can be prevented by anti-csrf tokens: Is that also a countermeasure against DNS rebinding?

1

CSRF and DNS rebinding are basically both cross-site request, but done differently and targeted against different protection mechanisms.

With CSRF the browser is aware that this is a cross-site request. This means that the Same Origin Policy will be applied. Thus, the request will be executed and will usually also include the cookies for the target site (i.e. kind of authenticated) but the attacker will not be able to read the response.

With DNS rebinding the browser is not aware that this is a cross-site request since the DNS name stays the same and only the target IP address changes. This means that no Same Origin Policy will be applied and thus the attacker can read the response. But, the browser will also not send any credentials and cookies for the real target server since it accesses the server with a different domain name than usual (the attacker controlled name instead of the real domain name) - and credentials and cookies are bound to a domain and not an IP address. This means that the request will not be authenticated automatically.

CSRF tokens will help in both cases since the attacker does not have access to the proper tokens. In case of CSRF it also helps if the servers checks the origin of the request (i.e. Referer and Origin header) while in case of DNS rebinding the server should verify that the value of the Host header is actually the server itself instead of an attacker-controlled domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.