There’s no place like 127.001: Achieving reliable DNS rebinding
Bypassing browser protections and network mitigations to reliably exploit local network services.
Summary
Trust Assumptions
People lock doors at night but rarely bolt furniture to floors. Similarly, developers treat local networks as trusted without implementing proper authentication. This assumption is dangerous.
DNS Rebinding Attacks
Same-origin policy assumes internal HTTP traffic is trusted. DNS rebinding bypasses this by exploiting implicit trust in local networks. Older techniques have been largely dismissed as unreliable.
Overcoming Limitations
The presentation covers DNS rebinding mechanics, browser mitigations, network defenses, and how to bypass each. The notorious unreliability that causes developers to ignore the issue is resolved through proper technique.
Practical Exploitation
Analysis of popular services shows how they are affected by DNS rebinding. A released tool automates attack generation and mitigation bypass. Live demonstration exploits vulnerable services to achieve remote code execution, proving practical exploit value.
Related talks
Main Stage·42 min
Gerald Doussot
Revives DNS rebinding as a practical attack against internal services and introduces the Singularity toolkit for automated exploitation.
DCGVR Village·1 hr 27 min
Dissecting the internals of Mozilla Firefox's Gecko rendering engine, exploring DOM fuzzing methodologies and memory corruption vulnerability classes.
Main Stage·37 min
Elliott Thompson
Shows how attacker-controlled web pages can pivot through DNS rebinding to attack consumer routers and LAN-connected devices.