skills.rest
Skobyn
SkobynCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-host-header

Detect and exploit host header vulnerabilities including SSRF, ATO, and cache poisoning.

Updated Jun 24, 2026
Search Tags:#ATO#SSRF#cache poisoning#host header injection#password reset poisoning
One-click install
npx skills add https://github.com/Skobyn/talon --skill hunt-host-header-skobyn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-host-header
Source: https://github.com/Skobyn/talon/tree/main/skills/hunt-host-header
Command: npx skills add https://github.com/Skobyn/talon --skill hunt-host-header-skobyn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, openssl, python, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and helps exploit host header vulnerabilities, such as SSRF, ATO, and cache poisoning, providing a comprehensive methodology for security assessments.

Core Features & Use Cases

  • Host Header Injection Detection: Detects vulnerabilities in how applications handle host headers.
  • Password Reset Poisoning: Identifies and mitigates password reset poisoning via host header manipulation.
  • Web Cache Poisoning: Discovers and addresses issues with web cache poisoning via unkeyed host headers.
  • SSRF via Host Header: Exploits SSRF through host header manipulation for internal service access.
  • OAuth/OIDC Poisoning: Detects and mitigates attacks on OAuth and OIDC endpoints using host header manipulation.
  • Quick Start: Automatically trigger relevant skills based on the description of the target environment.

Quick Start

Run the skill by describing the target in plain English, such as "Test the host header injection in acme.com".

Frequently Asked Questions about hunt-host-header

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for host header injection vulnerabilities in a web application?▼

Password reset poisoning exploits host header manipulation to send reset links pointing to an attacker-controlled domain. This Skill identifies and helps exploit password reset poisoning vulnerabilities during security assessments.

Can I detect web cache poisoning through unkeyed host headers?▼

SSRF via host header manipulation allows internal service access by altering the Host header value. This Skill exploits SSRF through host header manipulation to test internal service exposure during security assessments.

Do I need curl and openssl to detect OAuth and OIDC host header poisoning?▼

Host header injection can lead to SSRF, account takeover (ATO), and cache poisoning by exploiting how web applications process the Host header. This Skill detects and exploits these vulnerabilities for security assessments.

What's the best way to check for SSRF through host header manipulation?▼

The best way to check for SSRF through host header manipulation is using automated scripts with curl and openssl. This Skill identifies and exploits SSRF vulnerabilities by altering host headers to access internal services.

Related Skills

Explore More Software Engineering Skills→
dmzoneilldmzoneill
2

security-audit

Audit network and TLS configurations with nmap, openssl, curl, and ssh-keyscan.

Community
Advanced
AcczdyAcczdy
2

testing-for-host-header-injection

Detect HTTP Host header injection vulnerabilities and generate a JSON findings report.

Community
Intermediate
riandeoliveirariandeoliveira

testing-for-host-header-injection

Detect HTTP Host header injection vulnerabilities during authorized security testing.

Community
Intermediate
bpnrockstarbpnrockstar

hunt-host-header

Detect and validate Host Header injection vulnerabilities in web applications.

Community
Advanced