New Techniques for Split-Second DNS Rebinding
summary
Shows two practical, fast DNS-rebinding techniques that exploit IPv6/DNS timing (a quad A timing trick for Safari and an IPv6-then-IPv4 ordering trick for Chromium) plus an iframe-based PNA bypass that injects script into a same-origin iframe to fetch local-only HTTP endpoints. Demonstrates a real exploit chain that extracts AWS IMDS credentials from automated screenshot/scanner workers, releases rebinder and DNS-delay tools, and notes constraints: target must serve plain HTTP, ignore Host, and attacker needs IPv6 access.
AI-written summary · about
chapters (9)
- 0:00Introduction to DNS rebinding
- 1:11Company security bug analysis
- 4:38DNS rebinding basics
- 9:30Exploiting the company product
- 12:00Limitations and faster attacks
- 15:39Safari exploitation techniques
- 19:30Chromium based browser attacks
- 24:57Live demo and tools
- 27:28Mitigations and future work
related talks
33mOffensive Javascript Techniques for Red Teamers
26mMisuse of DNS, the Second Most Used Protocol
29mMaginotDNS: Attacking the Boundary of DNS Caching Protection
47mDNS On Fire
01h 04mServer-Side Browsing Considered Harmful
48mA Weakness In Chrome & A New Hacking Technique
16mDNS FLaRE: A Flush-Reload Attack on DNS Forwarders
45mMCPwned: Hacking MCP Servers with One Skeleton Key... (Jonathan Leitschuh)