Top 10 winner

DNS Rebinding (3-part series)

A worked scenario for combining persistent cookies with DNS rebinding: the attacker's site plants a cookie carrying an XSS payload, forces a browser restart to release the DNS pin, then rebinds to an intranet address. The intranet server ignores the wrong Host header, reflects the cookie and runs the payload. Mitigations: TLS, host-header checks, clearing cookies on exit.

In the archive

• Ranked #10 in the 2009 Top 10 Web Hacking Techniques

Related sources

• DNS Rebinding for Scraping and Spamming
• Session Fixation Via DNS Rebinding
• Author’s follow-up explanation

Tags

• dns
• dns-rebinding
• cookie
• xss
• same-origin-policy
• mitigation
• https
• owasp-a01-2021
• owasp-a02-2021
• owasp-a03-2021
• owasp-a07-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.