Lab 89 — PingRadar — SSRF via DNS Rebinding (TOCTOU)

hackadvisor

Task: PingRadar monitoring platform validates monitor URLs by resolving hostnames and checking against IP blocklist at creation time, but re-resolves DNS at check time (TOCTOU). Built-in DNS server supports round-robin A records with TTL=0. Solution: create a DNS zone with round-robin A record alternating between public IP (8.8.8.8) and 127.0.0.1, create monitor targeting http://ssrf.rebind.zone:3001/internal/flag — validation passes when DNS returns public IP, check execution hits localhost when DNS returns 127.0.0.1.