Intermediate LevelWeb Security & Cyber Defense
What is a DNS Rebinding Attack and how do you defend internal web servers?
❓ Interview Prompt: Explain DNS Rebinding, short TTL manipulation, bypassing Same-Origin Policy, targeting `localhost` services, and HTTP Host header validation.
DNS Rebinding allows an attacker's website to bypass the browser Same-Origin Policy (SOP) and interact with private internal network services ('http://localhost:8080'):
Attack Sequence:
1
Victim visits 'http://attacker.com' (DNS resolves to attacker's IP '203.0.113.5' with 'TTL=0').
2
Attacker JS makes a request. DNS rebinds 'attacker.com' to internal IP '127.0.0.1'.
3
Browser thinks 'http://attacker.com' is still the same origin, allowing the script to read private local data!
•
Defense: Validate incoming HTTP 'Host' headers strictly on internal web servers.
Code Implementation Example
typescript
app.use((req, res, next) => {
const allowedHosts = ['localhost:3000', '127.0.0.1:3000'];
// Reject requests with unexpected Host headers (Neutralizes DNS Rebinding!)
if (!allowedHosts.includes(req.headers.host || '')) {
return res.status(403).send('Invalid Host Header');
}
next();
});💡Validating HTTP Host header to defend against DNS Rebinding attacks.
🎯 Interview Key Takeaway
Validate the HTTP Host header on internal web servers to block DNS Rebinding attacks.
#DNS Rebinding#SOP#Host Header#Intermediate
Back to all Web Security & Cyber Defense Questions→