Collected research

Effects of DNS Rebinding On IE's Trust Zones

ha.ckers.org web application security lab - Archive » Effects of DNS Rebinding On IE’s Trust Zones

An email from natron chaining DNS rebinding into NTLM theft. Windows XP's NBNS transaction IDs start at 0x8000 and step by one to four, so a Java applet can spam predictable spoofed responses; Active Directory DNS also accepts unauthenticated update records. Either route places an attacker host in IE's Intranet or Trusted zone, where NTLM-over-HTTP authenticates automatically.

Record

Document

ha.ckers.org web application security lab - Archive » Effects of DNS Rebinding On IE’s Trust Zones

Published by

ha.ckers.org

Topic

Other

In the archive

• Collected in the 2007 research round

Tags

• dns-rebinding
• dns
• sso
• auth-bypass
• java
• privilege-escalation
• attack-chain
• owasp-a01-2021
• owasp-a07-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of ha.ckers.org, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.