4 ms·
DNS rebinding attacks leverage this very behaviour. And they exist since years. Nothing new. And I think fixing the approach is complex and error prone. I can s
by alanfranz 7y ago
DNS rebinding attacks leverage this very behaviour. And they exist since years. Nothing new. And I think fixing the approach is complex and error prone. I can still make the browser connect to myhost.mydomain.com and have it resolve to 127.0.0.1 - what then?
Of course if your local webservers have a really open CORS header, that could be a problem. But it's a matter for local webserver, mostly. And DNS rebinding still applies.
- amarshall 7y agoTo mitigate this, I configure my LAN’s DNS server to drop records which specify local or private addresses. Of course, this doesn’t help outside my LAN. In Unbound: private-address: 192.168.0.0/16 private-address: 172.16.0.0/12 private-address: 10.0.0.0/8 private-address: 169.254.0.0/16 private-address: 127.0.0.1/8 private-address: fd00::/8 private-address: fe80::/10 private-address: ::ffff:0:0/96 private-address: ::1/128