Bypass SSRF with DNS Rebinding
Introduction
Server-Side Request Forgery (SSRF) is a security hole that allows an attacker to manipulate a server into making HTTP requests to locations where they should not be. This loophole is often exploited to access internal resources such as cloud metadata, internal APIs, or perform port scanning on internal networks.
One technique to get around SSRF restrictions is DNS Rebinding, which allows the same domain to respond with different IP addresses in a short period of time. This technique is useful for bypassing whitelisting or domain-based access restrictions.
Discovery and Exploitation
1. Finding Vulnerable Endpoints
While pentesting, I found a redirect API endpoint that was potentially vulnerable to SSRF. The first step was to test using Burp Collaborator to see if requests to the domain I control could be executed by the server.
The results showed that the request was valid and the server did connect to the domain I specified. This indicates that SSRF might be exploited further.
2. Port Scanning with Burp Intruder
After confirming SSRF, I tried port scanning the internal network using Burp Intruder and Burp Collaborator. However, the results showed a lot of false positives, which means there might be a filtering mechanism or access restriction based on domain/IP.
3. Using DNS Rebinding
Given the access restrictions, I tried the DNS Rebinding technique to bypass the existing protections.
Bypass steps with DNS Rebinding:
- I register a domain that I control (e.g. evil.com).
- I set the DNS server to respond to that domain with two different IPs alternately:
- First IP: Public IP (e.g. 1.2.3.4) to bypass the whitelist.
- Second IP: Internal IP (e.g. 127.0.0.1 or 192.168.1.1) to perform port scanning after the DNS resolution changes.
- With this method, I successfully port scanned the internal network.
Conclusion
DNS Rebinding technique can be used to exploit SSRF which has restrictions based on specific domains/IPs. By utilizing dynamic DNS resolution changes, attackers can redirect requests to internal networks and perform port scanning or further exploitation.
Mitigation
To prevent this exploitation, some measures that can be implemented are:
- Use fixed IP resolution for permitted domains.
- Block access to private IP ranges on requests originating from web applications.
- Strictly validate input parameters containing URLs.
- Implement outbound request allowlist with active monitoring of changing DNS resolutions.
By understanding this technique, it is hoped that security professionals can be more aware of the DNS Rebinding threat in the context of SSRF and implement appropriate mitigations to prevent exploitation on their systems.
Timeline
Report Hackerone: 09–02–2025
Response Hackerone : 10–02–2025
Status : Duplicate
