Question

During a web application test, you discover an endpoint that fetches remote URLs supplied by the user to generate link previews. The application blocks requests to RFC 1918 addresses and localhost by resolving the hostname once and validating the resulting IP before making the request. You control an external domain and its authoritative DNS server. Which technique most effectively bypasses this filter to reach an internal service?

Accepted Answer

Use a DNS rebinding attack: return a public IP on the first resolution (validation) and an internal IP with a very low TTL on the second resolution (fetch)

Answer

Encode the internal IP address in hexadecimal or octal notation within the URL to evade the string-based blocklist

Answer

Submit a URL with an @ symbol so the application parses the internal host as credentials rather than the destination

Answer

Send the request over HTTPS so the TLS layer prevents the application from inspecting the destination IP address