DNS Rebinding Turns Name Resolution Into a Moving Network Boundary
A browser loads script from an attacker-controlled hostname while that name resolves to a public server. Seconds later, another lookup for the same hostname returns a private address such as an RFC 1918 destination. The browser still sees the same scheme, host, and port in the URL, yet a subsequent connection can terminate at a different machine. That gap between web origin identity and network destination is the basis of DNS rebinding. The same-origin policy primarily reasons about origins expressed through URL components; it does not define an origin by the IP address selected by DNS for each connection. An attacker who controls both a hostname and its DNS answers can exploit that separation when a browser is permitted to resolve the name to a target reachable from the user’s network.