DNS Rebinding: a beginner guidance

DNS REBIND: A KALI LINUX TOOL

what is DNS rebind?

DNS rebinding is a cyberattack that uses the Domain Name System (DNS) to trick a victim's browser into running a malicious script that attacks devices on the victim's private network.

In a DNS rebinding attack, hackers trick the victim’s browser into running a client-side script that attacks machines on the victim’s private network that are not exposed to the public internet. These attacks also establish communication between the attacker’s server and a web application on the victim’s network, typically for running malware or facilitating other malicious acts.

how does it work: 

1. A malicious website pretends that IP addresses reserved for local networks are part of their domain. 

2. The victim's browser runs a client-side script that attacks machines on the victim's private network. 

3. The attacker's server establishes communication with a web application on the victim's network. 

4. The attacker can then run malware or facilitate other malicious acts. 

Private Network Penetration With DNS Rebinding

The initial step of the DNS rebinding attack is the same as other web-based attacks: tricking victims into opening malicious websites through various social engineering techniques such as sending phishing emails and cybersquatting.

Use interface eth0 (-i eth0) to conduct the rebind attack with the specified domain (-d kali.local):

root@kali:~# rebind -i eth0 -d kali.local

[+] Starting DNS server on port 53
[+] Starting attack Web server on port 80
[+] Starting callback Web server on port 81
[+] Starting proxy server on 192.168.1.202:664
[+] Services started and running!

> dns
[+] 192.168.1.202       kali.local.
[+] 192.168.1.202       www.kali.local.
[+] 192.168.1.202       ns1.kali.local.
[+] 192.168.1.202       ns2.kali.local.

CONCLUSION:

DNS is a system that helps browsers find websites by their names. It links domain names to IP addresses. The information about which IP addresses belong to a domain is contained on DNS servers, which store the data and cache the records from other servers.