0

I'm currently testing a site where the host header is used for creating a recovery email link. However, when I try to manipulate the host header in Burp I get an HTTP 400 message saying I'm using an invalid hostname. I get this error even if I only try to tamper the host header for GET / or any other request.

My initial thought was that due to it being an App Service on Azure the host was not found and had no binding on the server and therefore it did not work. However, on the same App Service server, there is another application hosted that I was allowed to test against. When I added a host header that I know exists on that server I still get same HTTP 400 error.

What is Microsoft doing to prevent this?

Ping checking that the domains are on the same server:

enter image description here

Example request, edited host and target but both domains are on the same server.

enter image description here

Message is always the same:

HTTP/1.1 400 Bad Request
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Fri, 06 Oct 2017 07:28:25 GMT
Connection: close
Content-Length: 334

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Bad Request - Invalid Hostname</h2>
<hr><p>HTTP Error 400. The request hostname is invalid.</p>
</BODY></HTML>

I can add an X-Forwarded-Host: mydomain.com to the request and it will go through but not pick up the header as host.

https://www.acunetix.com/blog/articles/automated-detection-of-host-header-attacks/

| improve this question | |
  • You appear to be pinging the same host twice. What is that meant to show? – Mike Ounsworth Aug 2 '18 at 15:20
  • @MikeOunsworth two different domains, hosted on the same server Azure App Service server. Bad question since I can’t remember why I thought that was relevant. – Ogglas Aug 2 '18 at 18:27
  • Oh I see now, the stuff under the red is different. I spent way too long squinting at the ping output trying to spot the difference. – Mike Ounsworth Aug 2 '18 at 18:57
0

Gonna give it a shot and answer this myself. The code responsible for sending out the email looks like this:

await emailRepository.SendResetPasswordTokenAsync(Url.Action("ResetPassword", "Authentication", new { token.Token }, Request.Url.Scheme), model.Email, token.User.FullName);

The vulnerable part is this bit:

Url.Action("ResetPassword", "Authentication", new { token.Token }, Request.Url.Scheme)

I created an application on my machine and tried creating URLs with IIS Express and changed host and got the exact same error. I think this error occurs because there is no default binding and because the request is issued using HTTPS. If I change the request to use standard HTTP the host header is interpreted and in the request below I end up on domain2.

enter image description here

However I also tried it using my local IIS with binding to catch all on port 80. Using the same code as the vulnerable application I was able to manipulate the host:

Code:

public ActionResult Index()
{
    var host = Request.Headers["host"];

    ViewBag.Title = $"Host: {host} Url Created: {Url.Action("Index", "Home", "", Request.Url.Scheme)}";

    return View();
}

enter image description here

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.