DNS Rebind Toolkit
A frontend JavaScript framework for developing DNS rebinding exploits against vulnerable LAN devices and IoT products.
What is DNS Rebind Toolkit?
DNS Rebind Toolkit is a JavaScript framework for creating and executing DNS rebinding attacks. It enables remote attackers to bypass router firewalls by using a victim's web browser as a proxy to access and exploit devices on a local network, such as IoT devices and services that would otherwise be unreachable from the internet.
Security researchers and penetration testers who need to demonstrate DNS rebinding vulnerabilities in controlled environments for educational or testing purposes.
Developers choose this toolkit because it provides a modular API with pre-built payloads for popular IoT devices, automates IP discovery and payload delivery, and includes a working DNS server (whonow) to facilitate the attack, making it a comprehensive educational resource for understanding this specific vulnerability.
Overview
A front-end JavaScript toolkit for creating DNS rebinding attacks.
Use Cases
Best For
- Demonstrating DNS rebinding vulnerabilities in IoT devices like Google Home, Roku, and Sonos speakers.
- Educational labs for security researchers to learn about browser-based network attacks.
- Penetration testing of local network services that are protected by firewall rules.
- Automating the discovery and exploitation of devices on a victim's subnet via WebRTC IP leaks.
- Building custom DNS rebinding payloads for specific network services using the provided modular API.
- Exfiltrating data from vulnerable local services to a remote server for analysis in a controlled environment.
Not Ideal For
- Organizations requiring legally compliant penetration testing tools with built-in safeguards.
- Projects needing broad-spectrum vulnerability scanners that cover multiple attack vectors beyond DNS rebinding.
- Environments where browser-based attacks are infeasible, such as server-side application security testing.
Pros & Cons
Pros
Includes ready-to-use attack scripts for popular devices like Google Home and Roku, as shown in the payloads/ directory, saving development time.
Provides DNSRebindAttack and DNSRebindNode objects for custom exploit building, detailed in the API section with example code.
Uses WebRTC to leak the victim's local IP and infer the subnet, automating target selection as described in the attack flow.
Works with the whonow DNS server to execute rebinding attacks, facilitating the core exploit mechanism mentioned in the README.
Cons
The server must run with sudo to bind to port 80, which poses security risks and complicates deployment in restricted environments.
WebRTC IP leaks fail in some browsers, as admitted in the README, reducing the reliability of the initial target discovery.
DNS rebinding can take over a minute per target due to DNS cache settings, making attacks time-consuming and less efficient.
Primarily for educational use, with disclaimers warning against illegal activity, limiting its application in professional security assessments.
Frequently Asked Questions
Related Projects
Singularity of OriginA DNS rebinding attack framework.
Whonow DNS ServerA "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)
drefDNS Rebinding Exploitation Framework
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.