The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [dns-rebinding]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
-2
votes
1answer
94 views

is it possible that an attacker catch a page name from history?

like if an attacker sets a dns rebinding would he be able to get the router name from the history so he can make his attack more accurate .
1
vote
1answer
117 views

Exact difference CSRF vs. DNS Rebinding attacks

I am currently studying CSRF and DNS Rebinding attacks and I am wondering what the exact difference is. As far as I understand, DNS rebinding is way to bypass CORS and thus get information from a ...
0
votes
0answers
111 views

How the new variation of DNS rebinding tunnel attack vector can be mitigated in the enterprise (NOT SME)?

I see in last days so many posts about this attack but nothing to suggest how to stop in the enterprise would be great to know what would be a good steps to follow to mitigate this risk in the ...
4
votes
1answer
116 views

Is it safe to exclude my own registered domain from rebinding protection?

I want to access my web server from the LAN and from the internet using the same name (www.my-own-domain.example). However, my router (Fritz!box) has rebind protection enabled and does not resolve DNS ...
2
votes
1answer
251 views

When implementing CORS, should I check for a correct HOST header in my webapp?

I have a backend web server that serves an API (over HTTPS) to a frontend browser client on a different subdomain. It uses CORS to allow this. The CORS spec directs you to not send the CORS headers ...
2
votes
2answers
926 views

Does HTTPS protect against DNS rebinding?

I've been playing around with DNS rebinding. I made a little setup and I have it working fine with regular HTTP requests. I then tried to get it working over HTTPS and had a little "duh" moment: ...
2
votes
1answer
291 views

DNS Rebinding attack - does this attack require victim to use an attacker's DNS server for resolution? How will that happen?

Usually a preferred DNS server will be set in router's configuration and it will be either the organization's server or some trusted public server. So how would attacker get the victim to use his DNS ...
5
votes
1answer
722 views

DNS Rebinding attack - will the victim's browser send cookies?

How does a DNS Rebinding attack work? How can it violate the Same-origin policy? Will the victim's browser send cookies to the remote server (specified by IP), when the domain is not the same as is ...
6
votes
3answers
5k views

Does DNS pinning protect against all DNS rebinding attacks?

I found an example of a DNS rebinding attack scenario in the paper "Dynamic Pharming Attacks and Locked Same-origin Policies for Web Browsers". Figure 1: An example of a dynamic pharming attack ...