Уроки модуля (4/4)
DNS rebinding e difese
DNS rebinding and defenses
With DNS rebinding, a name can resolve to one address and later to another. A browser may keep the same origin name while a page causes it to contact a private address on the user’s network. Short TTLs can be part of the pattern, but the risk comes from trusting a name while ignoring the destination and request context.
Services should validate host names and destinations on the server side, reject unexpected private or link-local targets where appropriate, use anti-CSRF protections, and avoid exposing unauthenticated administrative interfaces. Browser and resolver behavior varies, so a DNS-only block is not a complete defense.
Never test rebinding against networks or services without permission. Use a controlled lab and document the exact trust boundary being tested.
Check your understanding
Choose the best answer. This quiz runs locally and sends no DNS queries to real domains.
Which control reduces unexpected requests to internal services?