0

I am trying to exploit Host Injection Vulnerability of a website.

If I change the host or add another host, what all are the HTTP response codes that will tell me about a successful HTML Host Injection Vulnerability?

I read a PoC (https://hackerone.com/reports/94637) of a HOST injection vulnerability where there was a 301 Moved Temporarily response when he changed host using Burp Suite and he was awarded a bounty.

What are all the HTML codes for successful HOST injection?

200 OK
301 Moved Temporarily 
and ??? 
5
  • it's really going to depend on the server and application .... potentially any non-error could indicate success ...
    – schroeder
    Commented Mar 26, 2017 at 15:29
  • It will be really helpful if u list all the html successful codes that will tell me about a successfull attack . i will accept the ans Commented Mar 26, 2017 at 15:56
  • 1
    You want me to list all HTTP success codes? There are sites that have that list. As I said above, how any one site responds will be up to that individual site.
    – schroeder
    Commented Mar 26, 2017 at 16:03
  • I want u 2 list the cods for successful host header injection that's all Commented Mar 26, 2017 at 16:08
  • HTTP error codes are anything in 4xx or 5xx category. Commented Mar 26, 2017 at 16:17

1 Answer 1

1

HTTP error codes are anything in 4xx or 5xx category. 4xx means client error, 5xx means server error. https://en.wikipedia.org/wiki/List_of_HTTP_status_codes. As schroeder indicates, any code in 1xx, 2xx, or 3xx category that you receive potentially means success.

0

Not the answer you're looking for? Browse other questions tagged .