📄 Starlink DNS Rebinding

==================================================================================================================================
    | # Title     : Starlink DNS Rebinding Exploit                                                                                   |
    | # Author    : indoushka                                                                                                        |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                 |
    | # Vendor    : indoushka                                                                                                        |
    ==================================================================================================================================
    
    [+] Summary    : This Python script implements a lightweight DNS rebinding detection system designed to monitor suspicious domain-to-IP resolution changes in real time. 
                     It behaves like a mini EDR sensor focused specifically on identifying DNS rebinding and IP-flapping patterns.
                     The tool continuously resolves a list of domains and tracks their historical IP resolutions. It analyzes changes over time to detect potentially malicious behavior, especially transitions from public to private IP ranges.
    
    [+] Key detection capabilities:
    
    Public → Private IP transition detection: Flags when a domain resolves from a public IP to a private/internal IP space, a common DNS rebinding indicator
    Rapid IP flapping detection: Identifies domains that resolve to multiple different IPs within a short window
    Time-windowed history tracking: Uses bounded deques to store recent DNS resolution history efficiently
    Thread-safe alert logging (lightweight): Stores and prints security events with severity and metadata
    Private IP classification: Uses ipaddress module to correctly identify RFC1918 internal ranges
    
    [+] Operational behavior:
    
    Continuously monitors configured target domains in a loop
    Performs periodic DNS resolution every few seconds
    Maintains historical resolution state per domain
    Triggers high-severity alerts when suspicious patterns are detected
    
    Overall, this script provides a simple but effective DNS rebinding monitoring mechanism suitable for lab environments, security research, or integration into larger threat detection pipelines.
    
    [+] POC   :  
    
    #!/usr/bin/env python3
    
    import socket
    import time
    import threading
    import ipaddress
    from collections import defaultdict, deque
    
    class DNSRebindingDetector:
        def __init__(self, window=60):
            self.domain_history = defaultdict(lambda: deque(maxlen=20))
            self.alerts = deque(maxlen=100)
            self.window = window
    
        def is_private_ip(self, ip):
            try:
                return ipaddress.ip_address(ip).is_private
            except:
                return False
    
        def resolve_domain(self, domain):
            try:
                return socket.gethostbyname(domain)
            except:
                return None
    
        def analyze(self, domain):
            ip = self.resolve_domain(domain)
            if not ip:
                return
    
            now = time.time()
            self.domain_history[domain].append((ip, now))
    
            history = list(self.domain_history[domain])
    
            if len(history) < 2:
                return
    
            old_ip = history[-2][0]
            new_ip = history[-1][0]
    
            if (not self.is_private_ip(old_ip)) and self.is_private_ip(new_ip):
                self.alert(domain, old_ip, new_ip, "PUBLIC_TO_PRIVATE_REBINDING")
    
            unique_ips = set([h[0] for h in history])
            if len(unique_ips) >= 3:
                self.alert(domain, old_ip, new_ip, "RAPID_IP_FLAPPING")
    
        def alert(self, domain, old_ip, new_ip, reason):
            event = {
                "domain": domain,
                "old_ip": old_ip,
                "new_ip": new_ip,
                "reason": reason,
                "severity": "HIGH",
                "timestamp": time.time()
            }
            self.alerts.append(event)
    
            print("\n[ DNS REBINDING ALERT]")
            print(event)
    
        def monitor(self, domains):
            while True:
                for d in domains:
                    self.analyze(d)
                time.sleep(2)
    
    
    if __name__ == "__main__":
        targets = [
            "example.com",
            "test.local"
        ]
    
        detector = DNSRebindingDetector()
        detector.monitor(targets)
    
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================