Dns Rebinding Attacks

This is a thorough playbook for DNS rebinding attacks, the client-side technique where you control DNS to make a browser resolve your domain to an internal IP while respecting same-origin policy. It covers the core mechanics (TTL manipulation, browser cache bypass via subdomains or multiple A records), attack variants including WebSocket rebinding and the hybrid TOCTOU server-side case, and high-value targets like cloud metadata services at 169.254.169.254 or internal Docker APIs. The skill includes practical tool references like Singularity and rbndr.us for zero-setup testing. Use this when you need to reach internal services from a browser context where traditional SSRF won't work, or when testing applications that trust DNS resolution for security decisions.

Install to Claude Code

npx -y skills add yaklang/hack-skills --skill dns-rebinding-attacks --agent claude-code