Operation Rebound

HOME LAB · LINUX · difficulty 5 · ~35 min · 18 steps

A public name resolved to your living room. The browser did the rest.

Briefing

Somebody in the house opened a page on a phone. Ninety seconds later the smart plugs cycled, Home Assistant logged an API call it did not expect, and the camera on the IoT VLAN started talking to an address in another country. Nothing was port-forwarded. Nothing was exposed. The firewall never saw an inbound connection, because there wasn't one — the request came from inside, from a browser, aimed at an address a public domain told it to use. Your resolver is a security control. Find out what it agreed to.

Objectives

• Read the resolver's cache and find the private answer
• Confirm the rebinding signature in a live query
• Prove the resolver has no rebinding protection configured
• Find what the IoT segment is reaching and what it is leaking
• Close the resolver, the segment and the discovery layer

Return to the range lobby