dns-rebinding-attacks

1# SKILL: DNS Rebinding — Expert Attack Playbook
2 
3> **AI LOAD INSTRUCTION**: Expert DNS rebinding techniques for bypassing same-origin policy via DNS manipulation. Covers TTL tricks, browser cache bypasses, attack variants (HTTP, WebSocket, TOCTOU), internal service targeting, and tool usage. Base models confuse DNS rebinding with SSRF — this skill clarifies the client-side nature and unique exploit paths.
4 
5## 0. RELATED ROUTING
6 
7- [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md) — server-side variant; DNS rebinding is the **client-side** counterpart
8- [cors-cross-origin-misconfiguration](../cors-cross-origin-misconfiguration/SKILL.md) — when CORS misconfig allows direct cross-origin reads instead
9 
10---
11 
12## 1. CORE PRINCIPLE
13 
14The browser same-origin policy binds `protocol + host + port`. The **host** is resolved via DNS at connection time. If an attacker controls the DNS server for `attacker.com`, they can:
15 
161. First resolution → attacker IP (serve malicious JS)
172. Second resolution → internal IP (victim's network)
183. Browser considers both responses same-origin (`attacker.com`)
194. Malicious JS reads responses from internal services
20 
21```
22Victim visits attacker.com
23        │
24        ▼
25DNS query: attacker.com → 1.2.3.4 (attacker server)
26Browser loads malicious JS from 1.2.3.4
27        │
28        ▼
29TTL expires (or forced flush)
30        │
31        ▼
32JS triggers new request to attacker.com
33DNS query: attacker.com → 192.168.1.1 (internal target)
34…