HTTP Host header injection and routing abuse playbook. Use when the application trusts the Host header for generating URLs, routing requests, or access control — enabling password reset poisoning, web cache poisoning, SSRF via routing, and virtual host bypass.

SKILL: HTTP Host Header Attacks — Injection & Routing Abuse AI LOAD INSTRUCTION : Covers Host header injection for password reset poisoning, cache poisoning, SSRF via routing, and virtual host bypass. Includes bypass techniques for Host validation and framework specific behaviors. Base models often miss the double Host trick, absolute URI override, and connection state attacks. 0. RELATED ROUTING [web cache deception](../web cache deception/SKILL.md) when Host injection is combined with cache behavior [ssrf server side request forgery](../ssrf server side request forgery/SKILL.md) when Host header routes requests to internal services [open redirect](../open redirect/SKILL.md) when Host injection causes redirect to attacker domain [waf bypass techniques](../waf bypass techniques/SKILL.md) when Host manipulation helps bypass WAF routing [request smuggling](../request smuggling/SKILL.md) when smuggling enables Host header manipulation past front end validation [subdomain takeover](../subdomain takeover/SKILL.md) when Host routing exposes internal vhosts resolvable via subdomain 1. ATTACK SURFACE The Host header is used by web applications and infrastructure for: Usage Exploitation URL generation (password reset links, email links) Inject attacker domain → user clicks link to attacker Virtual host routing Spoof Host → access internal/admin vhost Cache key component Inject different Host → poison cache for all users Reverse proxy routing Host determines backend → SSRF to internal services Access control decisions Host based ACLs can be bypassed Canonical URL / SEO redirects Host injection → open redirect 2. PASSWORD RESET POISONING The most common and impactful Host header attack. How It Works Testing Check Burp Collaborator for incoming HTTP request with the reset token. Variants Some apps concatenate: Host: target.com.attacker.com → link becomes https://target.com.attacker.com/reset?token=xxx Some apps use only the port portion: Host: target.com:@attacker.com → parsed as attacker.com in some URL parsers 3. WEB CACHE POISONING VIA HOST Key requirement : Cache must not include Host header in cache key, but application must use Host in response body. Test by sending two requests with different Host values and checking if the second request returns the first's Host in the response. 4. SSRF VIA HOST ROUTING When a reverse proxy uses Host header to route to backends: Common in: Nginx proxy pass based on $host Apache ProxyPass with virtual host routing Kubernetes Ingress controllers Cloud load balancers 5. VIRTUAL HOST BYPASS Many servers host multiple applications on the same IP via virtual hosting: Discovery 6. BYPASS TECHNIQUES WHEN HOST IS VALIDATED 6.1 Override Headers Many frameworks/proxies trust these headers over the Host header: Header Frameworks That Trust It X Forwarded Host Symfony, Laravel, Django (when USE X FORWARDED HOST=True ), Rails (behind proxy) X Host Some custom proxy configurations X Original URL IIS with URL Rewrite module X Rewrite URL IIS with URL Rewrite module Forwarded: host=attacker.com RFC 7239 compliant proxies X Forwarded Server Apache mod proxy Test all simultaneously: 6.2 Absolute URL in Request Line Per HTTP/1.1 spec (RFC 7230): if the request line contains an absolute URI, the Host header SHOULD be ignored. Some servers follow this, some don't — the mismatch between proxy and backend creates the vulnerability. 6.3 Double Host Header Behavior varies: Some proxies validate first Host, app uses second Some servers concatenate: target.com, attacker.com RFC says: if both differ, return 400. Most servers don't. 6.4 Host with Port / Credentials URL parsers may extract the "host" portion differently when credentials ( @ ) or fragments ( ) are present. 6.5 Trailing Dot DNS treats target.com. and target.com identically (trailing dot = FQDN). But Host validation may not strip the trailing dot → target.com. ≠ target.com in string comparison → bypass whitelist. 6.6 Tab / Space Injection Some parsers split on whitespace; the server may use attacker.com portion while validation checks target.com portion. 6.7 Wrap Around / Enclosed Values Quoted or bracketed values may be stripped by the app but not by the validator. 7. FRAMEWORK SPECIFIC BEHAVIOR Framework Host Source Gotcha PHP $ SERVER['HTTP HOST'] (raw header, directly injectable) SERVER NAME is safer only with UseCanonicalName On Django HttpRequest.get host() checks X Forwarded Host first (if enabled) USE X FORWARDED HOST=True bypasses ALLOWED HOSTS Rails request.host from Host header; trusts X Forwarded Host behind proxy Rails 6+ HostAuthorization middleware mitigates Node/Express req.hostname / req.headers.host ; with trust proxy uses X Forwarded Host No built in host validation 8. CONNECTION STATE ATTACKS A sophisticated variant exploiting HTTP keep alive: This works against proxies that perform Host validation only on the first request of a keep alive connection. Testing 9. HOST HEADER ATTACK DECISION TREE 10. TRICK NOTES — WHAT AI MODELS MISS 1. Password reset poisoning doesn't require the victim to be logged in — you request the reset, the victim just clicks the link. The token lands on your server. 2. X Forwarded Host is the 1 missed bypass : Most Host validation checks Host header but frameworks silently prefer X Forwarded Host when behind a proxy. 3. Double Host header is protocol valid but behavior undefined : RFC says reject with 400, but almost no server actually does this. The mismatch between proxy and app is the vulnerability. 4. Absolute URI overrides Host per RFC : GET http://evil.com/path HTTP/1.1\nHost: target.com — the spec says use the request line URI. But not all implementations agree. 5. Cache poisoning via Host requires the cache to exclude Host from the key : Most CDNs include Host in the cache key. But custom Varnish/Nginx caches may not. Also test with X Forwarded Host as cache key differentiator. 6. Connection state attacks are rarely tested : Automated scanners don't test keep alive behavior. Manual testing via Burp Repeater's connection reuse is essential. 7. DNS rebinding + Host attacks : If you control DNS, point your domain to the target's IP → your domain resolves to their server → Host header says your domain, but request hits their server. Useful for bypassing IP based access controls.

http-host-header-attacks