5

How does a DNS Rebinding attack work? How can it violate the Same-origin policy?

Will the victim's browser send cookies to the remote server (specified by IP), when the domain is not the same as is in the cookie, created by the same remote server before (keeping the user session)?

6

"The attacker registers a domain (such as attacker.com) and delegates it to a DNS server he controls. The server is configured to respond with a very short time to live (TTL) record, preventing the response from being cached. When the victim browses to the malicious domain, the attacker's DNS server first responds with the IP address of a server hosting the malicious client-side code.

The malicious client-side code makes additional accesses to the original domain name (such as attacker.com). These are permitted by the same-origin policy. However, when the victim's browser runs the script it makes a new DNS request for the domain, and the attacker replies with a new IP address. For instance, he could reply with an internal IP address or the IP address of a target somewhere else on the Internet."

Simplifying:

  1. Victim enter in evil.com
  2. evil.com responds with X.X.X.X (IP of malicious server)
  3. X.X.X.X loads a malicious script
  4. Malicious scripts makes requests to evil.com (same domain)
  5. But now evil.com responds with 201.82.108.103 (IP of Google)

Attack done! The malicious script can now makes requests to Google (pseudo Cross-Site Scripting), because theoretically it is not violating same-origin policy. It is accessing Google, but using evil.com as domain, and it was loaded under evil.com, so the browser can not see any problem with the requests.

  • And it will send cookies for google.com? – programings Nov 28 '14 at 8:58
  • 1
    no, since the cookies are bound to domain, not IP. However, if Google is vulnerable to session fixation, evil.com could send a cookie with their own session ID in it to Google via the user's browser, and when the user logs in with their credentials, the cookie fron evil.com is set to a logged-in state. – sebastian nielsen Nov 28 '14 at 16:08
  • 1
    I don't think this is accurate at all. No modern browser should be vulnerable to this. DNS rebinding was patched years ago. – rook Nov 30 '14 at 1:14
  • @Rock Yes, you are right. I just answered how the vulnerability worked and could work in other environments. – Lucas NN Nov 30 '14 at 2:33
  • @LucasNN, How could DNS Rebinding even work for HTTP 1.1? Those AJAX requests that are trying to bypass sameoriginpolicy are still going to send a header Host: attacker.com. And the request would obviously fail because the victim server wouldn't reply anything relevant since it doesn't host any pages for attacker.com... – Pacerier Dec 29 '15 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.