Скачать или смотреть DNS Rebinding with Java URL.Equals; web/webwebhookook IrisCTF 2025

Capture the flag (CTF) challenge from IrisCTF 2025. The challenge was web/webwebhookhook written be Sera.

Topics covered:
DNS Rebinding
TOCTOU (time of check, time of us)
Java URL.Equals (dns lookup)

00:00 Intro
00:38 Challenge Description
03:04 Java URL.Equals
06:45 Attack Overview
10:53 DNS Caching
13:07 Solution Script
14:04 Other Solutions
16:51 Remediation

References:
https://github.com/IrisSec/IrisCTF-20...
https://docs.oracle.com/javase/8/docs...
https://bugs.java.com/bugdatabase/vie...
https://www.w3.org/TR/uri-clarification/
   • Gerald Doussot - State of DNS Rebinding At...  

Other Writeups:
https://github.com/Seraphin-/ctf/blob...
https://zimzi.substack.com/p/irisctf-...
https://jorianwoltjer.com/blog/p/ctf/...
https://tomadimitrie.dev/posts/webweb...