Skip to content
attack.paths
Connexion
← RegistryDossier · 6 steps · 5 edges

DNS rebinding → access internal router admin from a browser

Victim visits attacker page. JS opens a connection to attacker.com, which after the first request flips its DNS A record to 192.168.1.1 — subsequent requests now go to the victim's router under the attacker's origin.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: victim runs an unpatched home / SMB router with default credentials reachable on its internal IP. Modern browsers honour short TTLs the attacker controls.

§ Steps

  1. 01
    Phish / drive-by visitInitial Access
    T1566— Phishing
  2. 02
    Hit router with default credsCredential Access
    W-AUTH-DEFAULT— Default Credentials
  3. 03
    Host JS page on attacker.comResource Development
    T1583— Acquire Infrastructure
  4. 04
    Stand up rebinding DNS server (whonow)Resource Development
    T1583— Acquire Infrastructure
  5. 05
    Reconfigure DNS / port forward / firmwareInitial Access
    IOT-OTA-MITM— OTA Update MITM
  6. 06
    DNS A flips to internal IPLateral Movement
    DNS-REBINDING— DNS Rebinding

§ References

§ Frequently asked

What is the "DNS rebinding → access internal router admin from a browser" attack path?
Victim visits attacker page. JS opens a connection to attacker.com, which after the first request flips its DNS A record to 192.168.1.1 — subsequent requests now go to the victim's router under the attacker's origin. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Phish / drive-by visit (T1566) — a initial access primitive. Assumed environment: victim runs an unpatched home / SMB router with default credentials reachable on its internal IP.
What is the final impact of this kill-chain?
The final step lands on DNS A flips to internal IP (DNS-REBINDING), which falls under Lateral Movement. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers