What problem does it solve? Web applications that trust the Host or X-Forwarded-Host headers can be exploited for account takeover, cache poisoning, and SSRF, but these bugs are easy to miss without a structured testing methodology. This Skill provides a phased, evidence-driven workflow for finding and validating Host header injection vulnerabilities during authorized bug bounty hunting. ## Core Features & Use Cases - Password Reset Poisoning: Tests whether forgot-password flows build reset links from attacker-controlled Host headers, enabling token capture and account takeover. - Web Cache Poisoning: Detects unkeyed X-Forwarded-Host reflection into cached responses, with false-positive checks using Vary headers, cache status, and clean-fetch verification. - SSRF and ACL Bypass: Distinguishes routing-based SSRF (Host steers the upstream to cloud metadata endpoints) from path-override attacks via X-Original-URL and X-Rewrite-URL. - Use Case: While testing a CDN-fronted target's forgot-password endpoint, inject a Burp Collaborator host via X-Forwarded-Host, confirm the reset email link points to your domain, and capture the token out-of-band as proof of account takeover. ## Quick Start Ask the AI to test the target's forgot-password endpoint for Host header injection using a Collaborator domain and validate whether the reset link uses the injected host.
