If you want to get a record that resolves to an IP, use the following subdomain:
For example, domain
make-126.96.36.199-rr.rebind.kaeferjaeger.gay resolves to
$ host -t A make-188.8.131.52-rr.rebind.kaeferjaeger.gay make-184.108.40.206-rr.rebind.kaeferjaeger.gay has address 220.127.116.11
You can use dashes instead of dots as long as the IP is valid:
$ host -t A make-1-2-3-4-rr.rebind.kaeferjaeger.gay make-1-2-3-4-rr.rebind.kaeferjaeger.gay has address 18.104.22.168
You can place some unique prefix/suffix before
make or after
rr (dots are allowed):
$ host -t A a.prefix-make-1-2-3-4-rr-and.a-suffix.rebind.kaeferjaeger.gay a.prefix-make-1-2-3-4-rr-and.a-suffix.rebind.kaeferjaeger.gay has address 22.214.171.124
Multiple records can be separated by
$ host -t A make-1-2-3-4-and-5-6-7-8-rr.rebind.kaeferjaeger.gay make-1-2-3-4-and-5-6-7-8-rr.rebind.kaeferjaeger.gay has address 126.96.36.199 make-1-2-3-4-and-5-6-7-8-rr.rebind.kaeferjaeger.gay has address 188.8.131.52
In the context of SSRF bugs, DNS rebinding is a well-known technique targeting TOCTOU type of vulnerabilities during IP blacklisting or whitelisting. It is performed using a domain that resolves in a legit IP during the first request (check) and to the forbidden one during the second request (use).
To generate a domain name with this behavior, use the following syntax:
For example, the domain name
make-184.108.40.206-rebind-169.254-169.254-rr.rebind.kaeferjaeger.gay will first resolve to
220.127.116.11 and then to
$ host -t A make-18.104.22.168-rebind-169.254-169.254-rr.rebind.kaeferjaeger.gay make-22.214.171.124-rebind-169.254-169.254-rr.rebind.kaeferjaeger.gay has address 126.96.36.199 $ host -t A make-188.8.131.52-rebind-169.254-169.254-rr.rebind.kaeferjaeger.gay make-184.108.40.206-rebind-169.254-169.254-rr.rebind.kaeferjaeger.gay has address 169.254.169.254
The logic behind the feature is as follows:
- if there were no requests to this domain during last 5 seconds, it's resolved to the first IP;
- otherwise, it's resolved to the second one.
You can use prefixes before
make- and suffix after
-rr in order to uniqualize the domain name (e.g.
prefix-make-220.127.116.11-rebind-169.254-169.254-rr-suffix.rebind.kaeferjaeger.gay). The timeouts are separate for each domain name.
If you need to change the default 5 seconds timeout, use the following syntax:
<interval> is something like
10s (10 seconds) or
5m (5 minutes).
If you need that "whitelisted" IP (which is IP1 in our examples) be returned multiple times before rebinding, use the following syntax:
make-18.104.22.168-rebindfor30safter2times-127.0.0.1-rr.rebind.kaeferjaeger.gay will resolve in
22.214.171.124 first two times, and then will resolve in
127.0.0.1 for next 30 seconds.
To make up a domain that resolves only to an IPv6 address, use the following syntax:
Colons must be replaced with letter
c. As always, random prefix and suffix can be used:
$ host -t AAAA prefix-make-ip-v6-1c2cc3-rr-suffix.rebind.kaeferjaeger.gay prefix-make-ip-v6-1c2cc3-rr-suffix.rebind.kaeferjaeger.gay has IPv6 address 1:2::3
By default, unparsable addresses are considered as CNAMEs:
$ host make-example.com-rr.rebind.kaeferjaeger.gay make-example.com-rr.rebind.kaeferjaeger.gay is an alias for example.com. ...
To force a domain to be a CNAME, add
$ host -t A make-cname-example.com-rr.rebind.kaeferjaeger.gay make-cname-example.com-rr.rebind.kaeferjaeger.gay is an alias for example.com. ...
Other record types
If the thing between
-rr is a parsable record, it is returned for any type of request.
$ host -t TXT make-blahblah-rr.rebind.kaeferjaeger.gay make-blahblah-rr.rebind.kaeferjaeger.gay descriptive text "blahblah"
You can encode the contents of a record in hex and add a
hex- prefix after
$ host -t A make-hex-312e322e332e34-rr.rebind.kaeferjaeger.gay make-hex-312e322e332e34-rr.rebind.kaeferjaeger.gay has address 126.96.36.199
Note on DNS TTLs
Some servers don't want to handle zero TTL replies. Default TTL is 1 for "service" domains and 0 for others.
If you want to change TTL, add
set-<number>-ttl anywhere in the domain name.
In 💖 with Kaeferjaeger.