3 ms·
This looks neat, but it seems like DNS Rebinding is likely more powerful here -- that would get you access to servers on the entire local network (not just the
by cjbprime 6y ago
This looks neat, but it seems like DNS Rebinding is likely more powerful here -- that would get you access to servers on the entire local network (not just the victim's own machine) without having to know the local browser's own IP first, so both the exploitation potential and the ease of carrying out the attack seem better for DNS Rebinding to me.
Also, DNS Rebinding exposes services which are only listening on local interfaces (127.0.0.1) and I suppose this wouldn't.
Could someone help me understand some common circumstances in which using NAT Slipstreaming would be a better choice?
- tprynn 6y agoWith DNS rebinding, you can still only send HTTP requests* to the target. With this attack, you have a direct, raw TCP/UDP socket. (*) I'm simplifying, what I mean is that DNS rebinding still limits you to only what you can do in the browser, which is effectively HTTP. Most non-HTTP services will generally just close your socket once they see you send an HTTP request.
- cjbprime 6y agoThanks. So the most likely scenario where it's worth the extra effort here would be to contact a non-HTTP TCP service on the victim's machine.