hunt-host-header

Host header injection enables account takeover when password reset poisoning tricks an application into sending reset links with an attacker-controlled host. This skill identifies such flaws in OAuth/OIDC implementations and reverse proxy configurations behind CDNs.

Testing web cache poisoning requires manipulating the Host header and manually verifying cache behavior to confirm exploitability. This skill provides a structured methodology to validate header reflection and prevent false positives in cache delivery.

Routing-based SSRF exploits web applications behind reverse proxies by injecting malicious Host headers to route requests to internal infrastructure. This skill detects these vulnerabilities and assesses their impact on infrastructure security using OOB capture validation.

Automated scanners often overlook complex Host header vulnerabilities like password reset poisoning and routing-based SSRF. This skill addresses that gap by providing exploit verification steps and requiring manual confirmation of header reflection to ensure accuracy.

Validating Host header injection without false positives requires manual verification of header reflection and cache behavior. This skill uses OOB capture via Collaborator to confirm exploitability and assess impact on authentication and infrastructure security.

Host header injection testing is effective for applications behind CDNs and reverse proxies. This skill specifically targets these configurations to detect routing-based SSRF and web cache poisoning vulnerabilities in OAuth/OIDC provider implementations.