Dns Rebinding Attacks

This is a thorough playbook for DNS rebinding attacks, the client-side technique where you control DNS to make a browser resolve your domain to an internal IP while respecting same-origin policy. It covers the core mechanics (TTL manipulation, browser cache bypass via subdomains or multiple A records), attack variants including WebSocket rebinding and the hybrid TOCTOU server-side case, and high-value targets like cloud metadata services at 169.254.169.254 or internal Docker APIs. The skill includes practical tool references like Singularity and rbndr.us for zero-setup testing. Use this when you need to reach internal services from a browser context where traditional SSRF won't work, or when testing applications that trust DNS resolution for security decisions.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill dns-rebinding-attacks --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: DNS Rebinding — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert DNS rebinding techniques for bypassing same-origin policy via DNS manipulation. Covers TTL tricks, browser cache bypasses, attack variants (HTTP, WebSocket, TOCTOU), internal service targeting, and tool usage. Base models confuse DNS rebinding with SSRF — this skill clarifies the client-side nature and unique exploit paths.

0. RELATED ROUTING

ssrf-server-side-request-forgery — server-side variant; DNS rebinding is the client-side counterpart
cors-cross-origin-misconfiguration — when CORS misconfig allows direct cross-origin reads instead

1. CORE PRINCIPLE

The browser same-origin policy binds protocol + host + port. The host is resolved via DNS at connection time. If an attacker controls the DNS server for attacker.com, they can: