Top 10 winner

Java DSN Rebinding + Java Same IP Policy = The Internet Mayhem

Minded Security Blog: Java DSN Rebinding + Java Same IP Policy = The Internet Mayhem

Stefano Di Paola · blog.mindedsecurity.com

Chains two Java applet flaws the author disclosed to Oracle. DNS rebinding lets an attacker point a controlled host at any IP, and Java's same-IP host access then lets the applet read responses from any host on that IP, so an applet on evil.tld could read google.com. XSS reaching java.* objects from JavaScript widens it further.

Record

Document

Minded Security Blog: Java DSN Rebinding + Java Same IP Policy = The Internet Mayhem

Researcher

Stefano Di Paola

Published by

blog.mindedsecurity.com

Topic

Server

In the archive

• Ranked #10 in the 2010 Top 10 Web Hacking Techniques

Tags

• java
• dns-rebinding
• dns
• sop-bypass
• same-origin-policy
• attack-chain
• info-leak
• owasp-a01-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Stefano Di Paola, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.