the-web-application-hackers-handbook

564 Chapter 13 n Attacking Users: Other Techniques
to cause the browser to resolve the attacker’s domain a second time, and
this time the domain name resolves to the IP address of a third-party
application, which the attacker is targeting.
n Subsequent requests to the attacker’s domain name are sent to the targeted
application. Since these are on the same domain as the attacker’s
original page, the same-origin policy allows the attacker’s script to
retrieve the contents of the responses from the targeted application
and send these back to the attacker, possibly on a different attackercontrolled
domain.
This attack faces various obstacles, including mechanisms in some browsers
to continue using a previously resolved IP address, even if the domain has been
rebound to a different address. Furthermore, the Host header sent by the browser
usually still refers to the attacker’s domain, not that of the target application,
which may cause problems. Historically, methods have existed by which these
obstacles can be circumvented on different browsers. In addition to the browser,
DNS rebinding attacks may be performed against browser extensions and web
proxies, all of which may behave in different ways.
Note that in DNS rebinding attacks, requests to the targeted application are
still made in the context of the attacker’s domain, as far as the browser is concerned.
Hence, any cookies for the actual domain of the target application are
not included in these requests. For this reason, the content that can be retrieved
from the target via DNS rebinding is the same as could be retrieved by anyone
who can make direct requests to the target. The technique is primarily of interest,
therefore, where other controls are in place to prevent an attacker from directly
interacting with the target. For example, a user residing on an organization’s
internal networks, which cannot be reached directly from the Internet, can be
made to retrieve content from other systems on those networks and transit this
content to the attacker.
Browser Exploitation Frameworks
Various frameworks have been developed to demonstrate and exploit the variety
of possible attacks that may be carried out against end users on the Internet.
These typically require a JavaScript hook to be placed into the victim’s browser
via some vulnerability such as XSS. Once the hook is in place, the browser
contacts a server controlled by the attacker. It may poll this server periodically,
submitting data back to the attacker and providing a control channel for receiving
commands from the attacker.