"The attacker registers a domain (such as attacker.com) and delegates it to a DNS server he controls. The server is configured to respond with a very short time to live (TTL) record, preventing the response from being cached. When the victim browses to the malicious domain, the attacker's DNS server first responds with the IP address of a server hosting the malicious client-side code.
The malicious client-side code makes additional accesses to the original domain name (such as attacker.com). These are permitted by the same-origin policy. However, when the victim's browser runs the script it makes a new DNS request for the domain, and the attacker replies with a new IP address. For instance, he could reply with an internal IP address or the IP address of a target somewhere else on the Internet."
- Victim enter in evil.com
- evil.com responds with X.X.X.X (IP of malicious server)
- X.X.X.X loads a malicious script
- Malicious scripts makes requests to evil.com (same domain)
- But now evil.com responds with 220.127.116.11 (IP of Google)
The malicious script can now makes requests to Google (pseudo Cross-Site Scripting), because theoretically it is not violating same-origin policy. It is accessing Google, but using evil.com as domain, and it was loaded under evil.com, so the browser can not see any problem with the requests.