http-host-header-attacks

HTTP Host header injection exploits how web applications use the Host header for URL generation and routing, enabling attacks like password reset poisoning, cache poisoning, and SSRF. Attackers manipulate the header to bypass access controls or redirect traffic.

To test for Host header injection, methodically manipulate the Host header in HTTP requests and observe how the application handles URL generation, routing, and access control. The testing process evaluates password reset flows, cache behavior, and redirects for vulnerabilities.

Common Host header validation bypass techniques include injecting X-Forwarded-Host headers, using absolute URLs, and sending double Host headers. These vectors exploit inconsistent header parsing across proxies and virtual hosts to achieve routing abuse.

Yes, this testing approach applies to discovering SSRF via routing abuse in web applications, proxies, and virtual hosts. It evaluates how manipulated Host headers redirect internal requests and bypass virtual host access controls.

Host header manipulation enables password reset poisoning by altering the URL generated for password reset links. When the application trusts the Host header for link construction, attackers can redirect reset emails to malicious domains and hijack accounts.

Testing Host header attacks against proxies may be limited by strict upstream header validation, normalized routing rules, or environments that override Host headers entirely. Some proxies strip manipulated headers before forwarding requests to the backend.