3 ms·
But that requires you to load the page resource from that origin already, so if you're already in control of it, what would you want to do that you couldn't alr
by capableweb 4y ago
But that requires you to load the page resource from that origin already, so if you're already in control of it, what would you want to do that you couldn't already?
- Thorrez 4y agoHere's how DNS rebinding works: 1. You have the victim user open a tab to your page at attacker.com . 2. After the page loads, you change the DNS record for attacker.com to make it point to 127.0.0.1 . 3. Javascript on the page makes requests to attacker.com and can now read and interact with whatever servers are running on the victim user's machine. Alternatively use 192.168.1.1 to attack the victim user's router. This attack will be blocked if the victim servers check the Host request header. Often they don't.