DNS Rebinding Attack Detection

Description

DNS Rebinding Bundle detects DNS rebind attacks in the network.

DNS Rebind is network attack that uses a malicious web page running client-side script that attacks / scans the private network of the victim.

How does this attack work?

1. Attacker with a DNS server with registered domain can run this attack to anyone visiting a malicious website the attacker created.
2. The attacker configures DNS server to respond with a very short TTL value, preventing DNS to be cached in victim's computer.
3. The first DNS request responds with an ip address of attacker's malicious website. The malicious code will then send another DNS request to the DNS server, which the DNS server responds with an IP address of private IP address to attack something in victim's private network.
4. This bypasses Same-Origin-Policy because the DNS name stays the same. it is only the ip address that changes.

More information about attacks that can be done with this attack can be read here

Requirements

ExtraHop version 6.2 or later

Installation Instructions

1. Download and Apply the bundle to your EDA
2. Assign DNS Rebinding Detection V2 trigger to DNS Server Device Group