Other nomination

DNS Rebinding on Java Applets

Stefano Di Paola

Java 6 exposed the Packages object to every browser, not just those with LiveConnect, so a JavaScript-instantiated applet runs in the JavaScriptProtectionDomain tied to the calling page's host. Rebinding that host to another IP extends Kanatoko Anvil's Firefox-only 2007 DNS rebinding attack to all browsers, letting the applet open sockets to the victim's site and steal cookies.

Record

Researcher

Stefano Di Paola

In the archive

• Nominated for the 2010 Top 10 Web Hacking Techniques

Tags

• dns-rebinding
• java
• sop-bypass
• same-origin-policy
• dns
• cookie
• prior-art-extension
• owasp-a01-2021
• owasp-a07-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Stefano Di Paola, first published at the original source. Preserved copies are kept so the citation survives its host.