DNS Rebinding Attack
network · medium · +45 XP
Target
POST /api/lab/dns-rebind-101/dns body {domain, ip, ttl} (set the A record)
GET /api/lab/dns-rebind-101/browser-fetch?url=... (mock browser fetch — re-resolves DNS each call)
GET /api/lab/dns-rebind-101/loot (flag iff browser fetched internal IP via rebind)
Goal: register attacker.io pointing to your IP first (passes SOP). Then re-point it to 127.0.0.1 (internal). Fetch http://attacker.io/admin — the second fetch hits internal admin. /loot then returns flag.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/dns-rebind-101/
// reuse on the cli
// submit flag
| # | hacker | solved |
|---|---|---|
| 1 | @akadee380 first blood | 2026-09-21 |