Rebind

Rebind provides an external attacker access to a target router’s internal Web interface. This tool works on routers that implement the weak end system model in their IP stack, have specifically configured firewall rules, and bind their Web service to the router’s WAN interface. Remote administration does not need to be enabled for this attack to work. All that is required is that a user inside the target network surf to a Web site that is controlled, or has been compromised, by the attacker.

Although originally written to target home routers, Rebind can be used to target any public (non RFC1918) IP address. It starts DNS server on port 53, attack Web server on port 80, callback Web server on port 81, and proxy server on a specified IP and port.

Rebind implements the multiple A record DNS rebinding attack. It responds to DNS queries with different IP addresses in successive responses, initially resolving to the attacker's server and then rebinding to the target's internal IP. This tricks the browser into bypassing same-origin policy, allowing access to internal services like router web interfaces bound to WAN.