Gerald Doussot - State of DNS Rebinding Attacks & Singularity of Origin
Revives DNS rebinding as a practical attack against internal services and introduces the Singularity toolkit for automated exploitation.
Summary
DNS Rebinding: Resurrected and Weaponized
Gerald Doussot presents updated DNS rebinding attack techniques and introduces Singularity of Origin, an open-source toolkit for automating DNS rebinding attacks against internal services.
The Attack Mechanism
DNS rebinding abuses the same-origin policy (SOP) by first pointing a domain at the attacker's server, delivering malicious JavaScript, then rapidly changing the DNS record to point at an internal IP. The victim's browser then sends XHR requests to the internal target, believing it's still on the attacker's origin.
Modern Browser Defenses and Bypasses
Browser vendors have attempted mitigations including DNS TTL pinning. Doussot demonstrates that many browsers still honor rebinding with TTLs as low as 0, and provides race-condition techniques to beat TTL-based protections.
Singularity Toolkit
The open-source Singularity tool automates the DNS server, payload delivery, and rebinding timing to attack routers, smart home devices, Kubernetes dashboards, and other internal web services exposed on RFC-1918 addresses.
Related talks
Main Stage·37 min
Elliott Thompson
Shows how attacker-controlled web pages can pivot through DNS rebinding to attack consumer routers and LAN-connected devices.
Main Track 1·42 min
Luke Young
Bypassing browser protections and network mitigations to reliably exploit local network services.
Village Interviews·1 min
A tour of the IoT Village at DEF CON 32 exploring hands-on router hacking, connected device vulnerability research, and zero-day labs.