3 ms·
I think this can be circumvented by DNS rebinding, though your requests won't have the authentication cookies for the target, so you would still need some kind
by IshKebab 1y ago
I think this can be circumvented by DNS rebinding, though your requests won't have the authentication cookies for the target, so you would still need some kind of exploit (or a completely unprotected target).
- MBCook 1y agoHow? The browser would still have to resolve it to a final IP right?
- IshKebab 1y agoI'm not sure what you mean but this explains it: https://github.blog/security/application-security/localhost-dangers-cors-and-dns-rebinding/#dns-rebinding https://github.blog/security/application-security/localhost-...