5

How does a DNS Rebinding attack work? How can it violate the Same-origin policy?

Will the victim's browser send cookies to the remote server (specified by IP), when the domain is not the same as is in the cookie, created by the same remote server before (keeping the user session)?

Improve this question
1

1 Answer 1

Reset to default
6

"The attacker registers a domain (such as attacker.com) and delegates it to a DNS server he controls. The server is configured to respond with a very short time to live (TTL) record, preventing the response from being cached. When the victim browses to the malicious domain, the attacker's DNS server first responds with the IP address of a server hosting the malicious client-side code.

The malicious client-side code makes additional accesses to the original domain name (such as attacker.com). These are permitted by the same-origin policy. However, when the victim's browser runs the script it makes a new DNS request for the domain, and the attacker replies with a new IP address. For instance, he could reply with an internal IP address or the IP address of a target somewhere else on the Internet."

Simplifying:

  1. Victim enter in evil.com
  2. evil.com responds with X.X.X.X (IP of malicious server)
  3. X.X.X.X loads a malicious script
  4. Malicious scripts makes requests to evil.com (same domain)
  5. But now evil.com responds with 201.82.108.103 (IP of Google)

Attack done! The malicious script can now makes requests to Google (pseudo Cross-Site Scripting), because theoretically it is not violating same-origin policy. It is accessing Google, but using evil.com as domain, and it was loaded under evil.com, so the browser can not see any problem with the requests.

Improve this answer
7
  • And it will send cookies for google.com?
    – programings
    Nov 28, 2014 at 8:58
  • 1
    no, since the cookies are bound to domain, not IP. However, if Google is vulnerable to session fixation, evil.com could send a cookie with their own session ID in it to Google via the user's browser, and when the user logs in with their credentials, the cookie fron evil.com is set to a logged-in state.
    – sebastian nielsen
    Nov 28, 2014 at 16:08
  • 1
    I don't think this is accurate at all. No modern browser should be vulnerable to this. DNS rebinding was patched years ago.
    – rook
    Nov 30, 2014 at 1:14
  • @Rock Yes, you are right. I just answered how the vulnerability worked and could work in other environments.
    – Lucas NN
    Nov 30, 2014 at 2:33
  • @LucasNN, How could DNS Rebinding even work for HTTP 1.1? Those AJAX requests that are trying to bypass sameoriginpolicy are still going to send a header Host: attacker.com. And the request would obviously fail because the victim server wouldn't reply anything relevant since it doesn't host any pages for attacker.com...
    – Pacerier
    Dec 29, 2015 at 14:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .