Details

Description

Detects DNS Rebinding attacks by checking if the DNS response contains a private IPv4 or IPv6 address.

Raw Output

{
  "extracted-results": [
    "10.64.4.216",
    "10.64.5.220"
  ],
  "extractor-name": "IPv4",
  "host": "easm.liifecore.com",
  "info": {
    "author": [
      "ricardomaia"
    ],
    "description": "Detects DNS Rebinding attacks by checking if the DNS response contains a private IPv4 or IPv6 address.\n",
    "metadata": {
      "max-request": 2
    },
    "name": "DNS Rebinding Attack",
    "reference": [
      "https://capec.mitre.org/data/definitions/275.html",
      "https://payatu.com/blog/dns-rebinding/",
      "https://heimdalsecurity.com/blog/dns-rebinding/"
    ],
    "severity": "unknown",
    "tags": [
      "redirect",
      "dns",
      "network",
      "discovery"
    ]
  },
  "matched-at": "easm.liifecore.com",
  "matcher-status": true,
  "request": ";; opcode: QUERY, status: NOERROR, id: 12913\n;; flags: rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 4096\n\n;; QUESTION SECTION:\n;easm.liifecore.com.\tIN\t A\n",
  "response": ";; opcode: QUERY, status: NOERROR, id: 12913\n;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;easm.liifecore.com.\tIN\t A\n\n;; ANSWER SECTION:\neasm.liifecore.com.\t60\tIN\tCNAME\tinternal-easm-tool-alb-788058289.us-east-1.elb.amazonaws.com.\ninternal-easm-tool-alb-788058289.us-east-1.elb.amazonaws.com.\t60\tIN\tA\t10.64.4.216\ninternal-easm-tool-alb-788058289.us-east-1.elb.amazonaws.com.\t60\tIN\tA\t10.64.5.220\n",
  "template": "dns/dns-rebinding.yaml",
  "template-id": "dns-rebinding",
  "template-path": "/opt/vulture/nuclei-templates/dns/dns-rebinding.yaml",
  "template-url": "https://cloud.projectdiscovery.io/public/dns-rebinding",
  "timestamp": "2026-07-14T02:03:10.631078321Z",
  "type": "dns"
}

Update Status