A malicious DNS server for executing DNS rebinding attacks dynamically via domain name requests.
Whonow is a malicious DNS server that enables DNS rebinding attacks by allowing users to specify dynamic DNS response rules through domain name requests. It solves the problem of setting up custom DNS servers for security testing by providing a public instance and a simple syntax to control IP address responses over time. This makes it easier to demonstrate and exploit browser same-origin policy vulnerabilities.
Security researchers, penetration testers, and educators who need to test or demonstrate DNS rebinding attacks and same-origin policy weaknesses in web browsers.
Developers choose Whonow for its unique ability to define DNS rebinding rules on-the-fly via domain names, eliminating the need to deploy custom DNS infrastructure. Its public server and straightforward syntax lower the barrier to entry for security testing and educational demonstrations.
A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Enables defining DNS rebinding rules directly in domain names using simple keywords like 'ntimes' and 'repeat', allowing complex IP response sequences without server reconfiguration.
Offers a shared server at rebind.network:53, so users can immediately test DNS rebinding attacks without self-hosting, lowering the barrier to entry.
Maintains per-domain program state in RAM, enabling persistent and sequential DNS responses for realistic attack simulations over multiple queries.
Can be installed via npm and run with minimal commands, with options for logging to CSV and verbose output for debugging.
Only supports A records for IPv4, with IPv6 noted as 'coming soon,' restricting use to IPv4 environments and missing common DNS features.
DNS specifications limit domains to 253 characters and 127 labels, which can hinder complex rule definitions with multiple IPs and rebinding sequences.
Requires unique UUIDs in domains to avoid program state interference between users, adding manual overhead and potential for errors in attack setups.
Designed explicitly for malicious activities, so improper use could lead to legal repercussions, and it's unsuitable for any legitimate or production DNS operations.