Collected research

DNS Rebinding for Credential Brute Force

DNS Rebinding for Credential Brute Force ha.ckers.org web application security lab

Second part of a DNS rebinding series: rebinding gives read access to a firewalled login page, so an attacker can brute-force weak, guessable authentication cookies such as username=bob or id=1234567 without ever learning a password. The recovered credential can then be used to fix the victim's session.

Record

Document

DNS Rebinding for Credential Brute Force ha.ckers.org web application security lab

Published by

ha.ckers.org

Topic

Other

In the archive

• Collected in the 2009 research round

Related sources

• Session Fixation Via DNS Rebinding

Tags

• dns
• dns-rebinding
• auth-bypass
• cookie
• session-fixation
• sop-bypass
• owasp-a01-2021
• owasp-a07-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of ha.ckers.org, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.