http-host-header-attacks

HTTP Host header injection enables password reset poisoning by tricking an application into generating password reset links with an attacker-controlled domain. If the server trusts the Host header for URL generation, the reset token is sent to the attacker's server, allowing account compromise.

Common Host header validation bypass techniques include injecting X-Forwarded-Host or Forwarded headers, using absolute-URI request lines, double-Host injection, port and credential parsing mismatches, trailing dots, whitespace/tab injection, and keep-alive connection-state edge cases to exploit normalization differences.

To test web cache poisoning using the Host header, inject an attacker-controlled Host value and check if the response reflects it in embedded links or scripts. If the cache key excludes the Host header, the poisoned response is served to other users.

Yes, you can achieve SSRF via Host header manipulation by targeting reverse proxies or load balancers that route backend services based on the Host value. Injecting internal Host values like localhost or admin can route requests to protected internal services.

Yes, this approach works with PHP, Django, Rails, and Node frameworks. It evaluates how each framework derives host information and tests specific middleware or proxy settings that alter Host header parsing, validation, and normalization behaviors.

Virtual host bypass is accessing restricted applications by manipulating the Host header to probe alternate vhosts. You enumerate alternate vhosts by brute-forcing Host values like localhost, admin, staging, and internal to discover hidden routing paths and access control weaknesses.