dns-rebind-toolkit - A front-end JavaScript toolkit for creating DNS re

项目说明

DNS Rebind Toolkit

Demo |
Security Ad |
Included Payloads |
FAQ

DISCLAIMER: This software is for educational purposes only. This software should not be used for illegal activity. The author is not responsible for its use. Don't be a dick.

DNS Rebind Toolkit is a frontend Ja framework for de DNS Rebinding exploits against hosts and services on a local area network (LAN). It can be used to target devices like Google Home, Roku, Sonos WiFi speakers, WiFi routers, "smart" thermostats, and other IoT devices. With this toolkit, a remote attacker can bypass a router's firewall and directly interact with devices on the 's home network, exfiltrating private information and in some cases, e the devices themselves.

The attack requires a on the target network to simply follow a link, or be shown an HTML ad containing a malicious iframe. From their, the 's web browser is used like a proxy to directly access other hosts connected to their home network. These target machines and services would otherwise be una to the attacker from the Internet. The remote attacker may not know what those services are, or what IP addresses they occupy on the 's network, but DNS Rebind Toolkit handles this by brute forcing hundreds of likely IP addresses.

Under the hood, this tool makes use of a public whonow DNS server running on rebind.network:53 to execute the DNS rebinding attack and fool the 's web browser into the Same-origin policy. From their, it uses WebRTC to leak the 's private IP address, say 192.168.1.36. It uses the first three octets of this local IP address to guess the network's subnet and then inject 256 iframes, from 192.168.1.0-255 deli a payload to each host that could possibly be on the network subnet.

This toolkit can be used to develop and deploy your own DNS rebinding attacks. Several real-world attack payloads are included with this toolkit in the payloads/ directory. These payloads include information exfiltration (and rickroll tom-foolery) attacks against a few popular IoT devices, including Google Home and Roku products.

> This toolkit is the product of independent security research into DNS Rebinding attacks. You can read about that original research here.

Getting Started

By default, server.js ser targeting Google Home, Roku, Sonos speakers, Phillips Hue light bulbs and Radio Thermostat devices running their services on ports 8008, 8060, 1400, 80 and 80 respectively. If you've got one of these devices on your home network, na to for a nice surprise ;). Open the de's console and watch as these services are harmlessly exploited causing data to be stolen from them and exfiltrated to server.js.

API and Usage

This toolkit provides two Ja objects that can be used together to create DNS rebinding attacks:

These two scripts are used together to execute an attack against unknown hosts on a firewall protected LAN. A basic attack looks like this:

1. Attacker sends a link to a malicious HTML page that launches the attack: e.g. . launcher.html contains an instance of DNSRebindAttack.
2. The follows the attacker's link, or a page where is embedded as an iframe. This causes the DNSRebindAttack on launcher.html to begin the attack.
3. DNSRebindAttack uses a WebRTC leak to discover the local IP address of the machine (e.g. 192.168.10.84). The attacker uses this information to choose a range of IP addresses to target on the 's LAN (e.g. 192.168.10.0-255).
4. launcher.html launches the DNS rebinding attack (using DNSRebindAttack.attack(...)) against a range of IP addresses on the 's subnet, targeting a single service (e.g. the undocumented Google Home REST API a on port 8008).
5. At an inter by the user (200 milliseconds by default), DNSRebindAttack embeds one iframe containing payload.html into the launcher.html page. Each iframe contains one DNSRebindNode object that executes an attack against port 8008 of a single host defined in the range of IP addresses being attacked. This injection process continues until an iframe has been injected for each IP address that is being targeted by the attack.
6. Each injected payload.html file uses DNSRebindNode to attempt a rebind attack by communicating with a whonow DNS server. If it succeeds, same-origin policy is and payload.html can communicate with the Google Home product directly. Usually payload.html will be written in such a way that it makes a few API calls to the target device and exfiltrates the results to server.js running on example.com before finishing the attack and destroying itself.

Note, if a user has one Google Home device on their network with an unknown IP address and an attack is launched against the entire 192.168.1.0/24 subnet, then one DNSRebindNode's rebind attack will be successful and 254 will fail.

Examples

An attack consists of three coordinated scripts and files:

launcher.html

Here is an example HTML launcher file. You can find the complete document in examples/launcher.html.

payload.html

Here is an example HTML payload file. You can find the complete document in examples/payload.html.

server.js

This script is used to deliver the launcher.html and payload.html files, as well as receive and sa data from the DNSRebindNode to the data/ folder. For de, I usually run this server on localhost and point DNSRebindAttack.attack(...) towards 127.0.0.1. For production, I run the server on a server and point DNSRebindAttack.attack(...) to its public IP address.

More Examples

I' an example server in examples/.js. This service MUST be run from another machine on your network, as it's port MUST match the same port as server.js. To run this example attack yourself, do the following:

#### Secondary Computer

#### Primary Computer

Now, na your browser to and open a de. Wait a minute or two, if the attack worked you should see some dumped credz from the ser on the secondary computer.

Check out the examples/ and payloads/ directories for more examples.

Files and Directories

This toolkit was de to be a useful tool for researchers and penetration testers. If you'd like to see some of the research that led to it's creation, check out this post. If you write a payload for another service, consider making a PR to this repository so that others can benefit from your work!

项目信息

开发语言：JavaScript

Star 数：504

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A front-end JavaScript toolkit for creating DNS rebinding attacks.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。