What problem does it solve? Applications behind CDNs and reverse proxies often trust Host, X-Forwarded-Host, or Forwarded headers inconsistently, causing password-reset links, absolute redirects, and multi-tenant routing to be generated with attacker-controllable hostnames. This Skill provides a scoped, evidence-gated workflow to verify whether a target actually generates non-allowlisted absolute URLs in sensitive flows. ## Core Features & Use Cases - Proxy Chain Modeling: Captures baseline requests and records how the CDN/edge layer handles Host, :authority, X-Forwarded-Host, X-Forwarded-Proto, and Forwarded headers. - Minimal Safe Validation: Changes one header at a time using HEAD requests, non-sending actions, or self-owned reset previews to avoid real email delivery or cross-tenant impact. - Strict Oracle and Stop Conditions: Only counts server-generated, controllable, non-allowlisted absolute URLs in sensitive flows as valid findings; CDN rejections, plain Host reflection, and uncontrollable Locations are explicitly not vulnerabilities. - Use Case: During an authorized assessment, test whether the password-reset flow builds its link from X-Forwarded-Host by sending a modified request to your own account and checking whether the generated link uses an attacker-controlled domain. ## Quick Start Ask the agent to verify whether the in-scope application's password reset flow trusts X-Forwarded-Host when generating absolute links, using only your own test account.
