skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-host-header

Identify and validate host header injection vulnerabilities in web applications.

1.1k|191|Updated Jun 24, 2026
Search Tags:#penetration testing#ssrf#vulnerability hunting#cache poisoning#host header injection#password reset poisoning#oauth poisoning
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-host-header-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-host-header
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-host-header
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-host-header-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Host header injection is a high-impact but frequently overlooked web vulnerability that can lead to account takeover, mass web cache poisoning, server-side request forgery, and OAuth credential theft. This Skill provides a structured, field-validated methodology for penetration testers to systematically identify, test, and validate these flaws in target applications.

Core Features & Use Cases

  • 5 High-Impact Attack Vectors: Covers password reset poisoning, web cache poisoning via unkeyed Host/X-Forwarded-Host headers, routing-based SSRF, path-override ACL bypass, and OAuth/OIDC poisoning.
  • False Positive Elimination: Includes explicit validation steps and checks to rule out non-exploitable reflections, cache misses, and keyed header behavior.
  • Use Case: During a pentest engagement against a CDN-fronted web application, use this Skill to test for host header flaws that could enable mass cache poisoning or account takeover via password reset link hijacking.

Quick Start

Use the hunt-host-header skill to test your target's forgot-password endpoint and OAuth authorization flow for exploitable host header injection vulnerabilities.

Frequently Asked Questions about hunt-host-header

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is host header injection and how does it lead to account takeover?▼

Host header injection exploits web applications and reverse-proxied infrastructure by manipulating the Host or X-Forwarded-Host header to hijack password reset flows, enabling account takeover, mass web cache poisoning, and OAuth credential theft.

How do I test for web cache poisoning via unkeyed Host headers?▼

Test for web cache poisoning by injecting malicious values into unkeyed Host or X-Forwarded-Host headers on CDN-fronted applications, then applying false positive elimination checks to validate if the response is actually cached and exploitable.

Can I use this methodology to test OAuth and OIDC endpoints for routing-based SSRF?▼

Yes, you can test OAuth/OIDC endpoints and internal service routing configurations to identify routing-based SSRF and OAuth poisoning vulnerabilities that may expose cloud metadata or steal credentials.

What is the best way to validate password reset poisoning flaws during a pentest?▼

The best way to validate password reset poisoning is using structured testing phases with explicit validation steps to rule out non-exploitable reflections, confirm keyed header behavior and cache misses, and assign severity ratings to exploitable flaws.

How do I eliminate false positives when hunting for host header vulnerabilities?▼

Eliminate false positives in host header vulnerability hunting by applying explicit validation checks that rule out non-exploitable reflections, cache misses, and keyed header behavior before confirming exploitable flaws leading to SSRF or account takeover.

Related Skills

Explore More Software Engineering Skills→
ricardoo022ricardoo022

scan-fase-5

Identify authentication weaknesses in Supabase-backed apps across signup, login, password reset, and OAuth flows.

Community
Advanced
cmndcntrlcybercmndcntrlcyber
3

hunt-ato

Analyze password reset flaws, MFA bypass, and session fixation for account takeover vulnerabilities.

Community
Advanced
riandeoliveirariandeoliveira

testing-for-host-header-injection

Detect HTTP Host header injection vulnerabilities during authorized security testing.

Community
Intermediate
cmndcntrlcybercmndcntrlcyber
3

hunt-ssrf

Detects and exploits Server-Side Request Forgery vulnerabilities in web applications.

Community
Advanced