I'm currently testing a site where the host header is used for creating a recovery email link. However, when I try to manipulate the host header in Burp I get an HTTP 400 message saying I'm using an invalid hostname. I get this error even if I only try to tamper the host header for GET /
or any other request.
My initial thought was that due to it being an App Service on Azure the host was not found and had no binding on the server and therefore it did not work. However, on the same App Service server, there is another application hosted that I was allowed to test against. When I added a host header that I know exists on that server I still get same HTTP 400 error.
What is Microsoft doing to prevent this?
Ping checking that the domains are on the same server:
Example request, edited host and target but both domains are on the same server.
Message is always the same:
HTTP/1.1 400 Bad Request
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Fri, 06 Oct 2017 07:28:25 GMT
Connection: close
Content-Length: 334
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Bad Request - Invalid Hostname</h2>
<hr><p>HTTP Error 400. The request hostname is invalid.</p>
</BODY></HTML>
I can add an X-Forwarded-Host: mydomain.com
to the request and it will go through but not pick up the header as host.
https://www.acunetix.com/blog/articles/automated-detection-of-host-header-attacks/