Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [dns-rebinding]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers

Will DNS rebinding attack still happen if browser caches the response for a long time?

In the DNS rebinding attack, if the victim’s browser caches the IP address for any hostname used in HTTP requests for an hour, can the attack still be successful? Why? I know it is a question ...
Xenon Kfr's user avatar
  • 101
0 votes
1 answer

Is a random unknown HTTP request header 'Host' that is reflected in the HTTP response 'Location" header (3xx) a open redirect or DNS rebinding?

If I send an unknown domain name in the HTTP request header 'Host' to a webserver and the webserver responds with a HTTP status code 301/302 (redirect) along with a HTTP response header 'Location' ...
Bob Ortiz's user avatar
  • 6,665
-1 votes
1 answer

DNSSEC is not configured for X website

I'm pretty new to this world of security and I'm doing some challenges trying to solve puzles of security, the thing is I have a website that is not loading it throws a timeout if I do ping, but ...
StuartDTO's user avatar
-2 votes
1 answer

is it possible that an attacker catch a page name from history?

like if an attacker sets a dns rebinding would he be able to get the router name from the history so he can make his attack more accurate .
mina nageh's user avatar
2 votes
1 answer

Exact difference CSRF vs. DNS Rebinding attacks

I am currently studying CSRF and DNS Rebinding attacks and I am wondering what the exact difference is. As far as I understand, DNS rebinding is way to bypass CORS and thus get information from a ...
MLStudent's user avatar
0 votes
0 answers

How the new variation of DNS rebinding tunnel attack vector can be mitigated in the enterprise (NOT SME)?

I see in last days so many posts about this attack but nothing to suggest how to stop in the enterprise would be great to know what would be a good steps to follow to mitigate this risk in the ...
Filipon's user avatar
  • 1,294
5 votes
2 answers

Is it safe to exclude my own registered domain from rebinding protection?

I want to access my web server from the LAN and from the internet using the same name ( However, my router (Fritz!box) has rebind protection enabled and does not resolve DNS ...
Al_'s user avatar
  • 61
2 votes
1 answer

When implementing CORS, should I check for a correct HOST header in my webapp?

I have a backend web server that serves an API (over HTTPS) to a frontend browser client on a different subdomain. It uses CORS to allow this. The CORS spec directs you to not send the CORS headers ...
MaxGabriel's user avatar
9 votes
2 answers

Does HTTPS protect against DNS rebinding?

I've been playing around with DNS rebinding. I made a little setup and I have it working fine with regular HTTP requests. I then tried to get it working over HTTPS and had a little "duh" moment: ...
Juicy's user avatar
  • 1,447
3 votes
1 answer

DNS Rebinding attack - does this attack require victim to use an attacker's DNS server for resolution? How will that happen?

Usually a preferred DNS server will be set in router's configuration and it will be either the organization's server or some trusted public server. So how would attacker get the victim to use his DNS ...
an0904's user avatar
  • 303
5 votes
1 answer

DNS Rebinding attack - will the victim's browser send cookies?

How does a DNS Rebinding attack work? How can it violate the Same-origin policy? Will the victim's browser send cookies to the remote server (specified by IP), when the domain is not the same as is ...
programings's user avatar
7 votes
3 answers

Does DNS pinning protect against all DNS rebinding attacks?

I found an example of a DNS rebinding attack scenario in the paper "Dynamic Pharming Attacks and Locked Same-origin Policies for Web Browsers". Figure 1: An example of a dynamic pharming attack ...
Honoki's user avatar
  • 211