Agent skill · security · yaklang
dns-rebinding-attacks
DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser context, or when SSRF is not possible server-side but the target has client-side fetch/XHR to attacker-controlled domains.
Why this skill is useful
Provides detailed attack scripts and strategies for executing DNS rebinding attacks that aren't commonly known.
What it needs
About 7k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: DNS Rebinding — Expert Attack Playbook AI LOAD INSTRUCTION: Expert DNS rebinding techniques for bypassing same-origin policy via DNS manipulation. Covers TTL tricks, browser cache bypasses, attack variants (HTTP, WebSocket, TOCTOU), internal service targeting, and tool usage. Base models confuse DNS rebinding with SSRF — this skill clarifies the client-side nature and unique exploit paths. 0. RELATED ROUTING ssrf-server-side-request-forgery — server-side variant; DNS rebinding is the client-side counterpart cors-cross-origin-misconfiguration — when CORS misconfig allows direct cross-origin reads instead --- 1. CORE PRINCIPLE The browser same-origin policy binds protocol + host + port. The host is resolved via DNS at connection time. If an attacker controls the DNS server for attacker.com, they can: 1. First resolution → attacker IP (serve malicious JS) 2. Second resolution → internal IP (victim's network) 3. Browser considers both responses same-origin (attacker.com) 4. Malicious JS reads responses from internal services Key insight: SOP checks the hostname string, not the resolved IP. DNS can change the IP behind the same hostname. --- 2. TTL MANIPULATION DNS server configuration The attacker runs an authoritative DNS server for their domain that alternates responses: Query # Response TTL --- --- --- 1st Attacker IP (e.g., 1.2.3.4) 0 2nd+ Target internal IP (e.g., 192.168.1.1) 0 TTL=0 tells resolvers not to cache the result, forcing re-resolution on next connection. Browser DNS cache reality Browsers maintain their own DNS cache that ignores low TTLs: Browser Internal DNS Cache Bypass Technique --- --- --- Chrome ~60 seconds minimum Wait 60s; or use multiple subdomains Firefox ~60 seconds (network.dnsCacheExpiration) Adjustable in about:config Safari ~varies Generally shorter cache Edge (Chromium) Same as Chrome (~60s) Same techniques as Chrome Bypass strategies --- 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/dns-rebinding-attacks