hunt-host-header

Host Header injection detection involves sending manipulated Host or X-Forwarded-Host headers to a target application and validating the server response. This identifies exploitable vectors for password reset poisoning and cache poisoning.

Password reset poisoning is an attack where a manipulated Host Header causes an application to generate password reset links pointing to an attacker-controlled domain. This allows attackers to capture reset tokens and achieve account takeover.

Yes, you can test for OAuth redirect_uri and issuer poisoning using curl to inject malicious Host headers. This validates whether the identity provider incorrectly trusts the forwarded header for redirect validation.

Yes, testing for Host Header injection works for finding routing-based SSRF and ACL bypass issues. By overriding the Host header, you can detect if internal routing rules trust the header to access restricted endpoints.

Yes, you need to manually confirm web cache poisoning results because automated scans identify potential unkeyed header vulnerabilities, but validating actual cache storage requires verifying the poisoned response is served to other users.

You should test for absolute-URL link poisoning when an application generates links based on the Host header. If the server trusts the injected header, generated absolute URLs will point to an attacker-controlled domain.