3 ms·

>OPTIONS requests OPTIONS requests only happen for cross-origin requests. With DNS rebinding, there are no cross-origin requests, so there will be no OPTIONS r

• capableweb 4y ago
  But that requires you to load the page resource from that origin already, so if you're already in control of it, what would you want to do that you couldn't already?
  • Thorrez 4y ago
    Here's how DNS rebinding works: 1. You have the victim user open a tab to your page at attacker.com . 2. After the page loads, you change the DNS record for attacker.com to make it point to 127.0.0.1 . 3. Javascript on the page makes requests to attacker.com and can now read and interact with whatever servers are running on the victim user's machine. Alternatively use 192.168.1.1 to attack the victim user's router. This attack will be blocked if the victim servers check the Host request header. Often they don't.