Elliott Thompson - MI CASA SU CASA: My 192.168.1.1 is Your 192.168.1.1
Shows how attacker-controlled web pages can pivot through DNS rebinding to attack consumer routers and LAN-connected devices.
Summary
LAN Pivoting via Browser
Elliott Thompson presents research on attacking home and small office networks from an external attacker's web page, using the victim's browser as a network pivot.
DNS Rebinding Chained with Router Exploits
Using DNS rebinding to satisfy the same-origin policy, Thompson's exploit code executes requests against the victim's router management interface (typically 192.168.1.1), exploiting known authentication bypass CVEs in popular consumer routers.
Beyond Routers: LAN Device Discovery
After gaining router access, the attacker can query the router's DHCP lease table to enumerate all connected devices and pivot to attack printers, NAS devices, and smart home hubs on the victim's LAN — all from a malicious web page.
Real-World Scope
Thompson demonstrates the attack against several top-selling router models and provides a browser-based scanning tool that enumerates common RFC-1918 ranges without requiring any local software installation.
Related talks
Main Stage·42 min
Gerald Doussot
Revives DNS rebinding as a practical attack against internal services and introduces the Singularity toolkit for automated exploitation.
Village Interviews·1 min
A tour of the IoT Village at DEF CON 32 exploring hands-on router hacking, connected device vulnerability research, and zero-day labs.
Main Stage·44 min
Noam Moshe · Sharon Brizinov
Claroty Team82 reveals how cloud connectivity features in Western Digital and Synology NAS devices allow remote compromise and full RCE across millions of devices.