skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

http-host-header-attacks

Identify Host header injection and routing abuse vectors in web applications.

241|28|Updated May 20, 2026
Search Tags:#ssrf#password reset#waf bypass#request routing#cache poisoning#host header#virtual host bypass
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill http-host-header-attacks-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: http-host-header-attacks
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/http-host-header-attacks
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill http-host-header-attacks-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Host header injection can poison links, bypass virtual-host access controls, and trigger SSRF when an application or reverse proxy trusts the HTTP Host header for routing or security decisions.

Core Features & Use Cases

  • Password reset poisoning via crafted Host values that cause reset links to be generated for an attacker domain.
  • Web cache poisoning where cache behavior ignores Host but response content embeds Host-derived URLs.
  • SSRF and virtual host bypass when Host-based routing forwards requests to unintended internal services or hidden vhosts.
  • Bypass techniques covering X-Forwarded-Host and other override headers, absolute-URI request lines, double-Host behavior, parser quirks, and connection-state keep-alive validation gaps.

Quick Start

Use the skill to test whether your target app reflects or operationalizes Host in password reset flows, redirects, cached responses, SSRF paths, or vhost routing by sending crafted Host variants and evaluating the resulting behavior and generated URLs.

Frequently Asked Questions about http-host-header-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How does Host header injection enable password reset poisoning?▼

Host header injection exploits applications that trust the HTTP Host header for URL generation, causing password reset links to point to an attacker-controlled domain instead of the legitimate server.

Can I bypass virtual host access controls using HTTP Host header manipulation?▼

Virtual host bypass is achievable by manipulating the Host header to influence reverse proxy routing, allowing access to hidden internal services or restricted vhosts by exploiting flawed Host-based access control logic.

What is the best way to test for web cache poisoning via Host header abuse?▼

Testing for web cache poisoning involves sending crafted Host variants to identify discrepancies where caching ignores Host but response content embeds Host-derived URLs, allowing injected content to be cached.

Does SSRF routing abuse require specific Host header bypass techniques?▼

SSRF routing abuse uses Host header manipulation combined with bypass techniques like X-Forwarded-Host override headers, absolute-URI request lines, and parser confusion payloads to forward requests to unintended internal services.

How do I validate if a reverse proxy is vulnerable to Host header routing flaws?▼

Validate reverse proxy vulnerabilities by sending crafted Host variants and evaluating responses for Host reflection, URL generation changes, and backend selection shifts during black-box testing of web applications.

When should I use absolute-URI request lines or double-Host headers for WAF bypass?▼

Use absolute-URI request lines, double-Host headers, and keep-alive connection-state payloads to bypass WAF and ACL logic when standard Host header injection fails to alter routing or response behavior.

Related Skills

Explore More Legal & Compliance Skills→
utsavthakurutsavthakur

http-host-header-attacks

Detect HTTP Host header injection and SSRF routing vulnerabilities.

Community
Advanced
EntroVyxEntroVyx
3

hunt-host-header

Identify and validate Host header injection vulnerabilities in web applications.

Community
Advanced
DorianGalloDorianGallo
5

http-host-header-attacks

Test HTTP Host header trust for redirect, cache, SSRF, and vhost bypass.

Community
Advanced
AcczdyAcczdy
2

testing-for-host-header-injection

Detect HTTP Host header injection vulnerabilities and generate a JSON findings report.

Community
Intermediate