Skip to main content

Questions tagged [host-header-injection]

Host header injection is an attack that fools the victim server to echo an incorrect host header.

Filter by
Sorted by
Tagged with
0 votes
1 answer
197 views

Is a random unknown HTTP request header 'Host' that is reflected in the HTTP response 'Location" header (3xx) a open redirect or DNS rebinding?

If I send an unknown domain name in the HTTP request header 'Host' to a webserver and the webserver responds with a HTTP status code 301/302 (redirect) along with a HTTP response header 'Location' ...
Bob Ortiz's user avatar
  • 6,705
0 votes
1 answer
667 views

How does Burp Collaborator payload reach the targeted vulnerable site?

I want to inject the collaborator payload in the HTTP Host header (HTTP Host header injection). GET / HTTP/1.1 Host: payload.collaborator.net The Host header is used to reach the targeted webserver ...
Just.a.tech's user avatar
1 vote
1 answer
154 views

To what attacks is using the value of the HOST header to craft self-referential URLs vulnerable?

From official ASP.NET Core docs, namely Routing in ASP.NET Core § URL generation concepts: Use GetUri* extension methods with caution in an app configuration that doesn't validate the Host header of ...
gaazkam's user avatar
  • 6,117
-1 votes
1 answer
1k views

CORS attack using authentication token [closed]

I found a website which is vulnerable to cors.(https://portswigger.net/web-security/cors) GET /api/requestApiKey HTTP/1.1. Host: vulnerable-website.com. Origin: https://evil.com. AUTHENTICATION: ...
Cyber World's user avatar
1 vote
2 answers
840 views

Do relative paths mitigate HTTP Host Header attacks?

I have been researching http host header attacks. There are many examples such as <a href="https://_SERVER['HOST']/support">Contact support</a>. Why would anyone use an absolute ...
Paul Blackburn's user avatar
0 votes
1 answer
1k views

How could someone exploit a host header injection vulnerability that only effects the responses Location header?

If I go to the http site e.g. http://www.example.com the site will redirect (code 301) to the https version https://www.example.com. On various pentests I observed that if I modify the Host header in ...
Zapho Oxx's user avatar
0 votes
1 answer
328 views

Can Proxy insert headers to a HTTPS requests which are on the same network?

I was reading about host header injection and found many reports on hackerone. Assume that if you inject X-Forwarded-Host header to specific requests, you may cause a redirect which can impact the ...
Malek's user avatar
  • 23
2 votes
1 answer
417 views

Arbitrary query parameter reflected in server response header. Is it exploitable?

SCENARIO: If I send requests like these: http://site.com/page?safe_param=1?my_arbitrary_param=2 The server responds with a normal HTTP response but within common headers it includes also the ...
Maicake's user avatar
  • 567
3 votes
2 answers
1k views

Why do Invalid Host header errors exist, what are attackers trying to achieve?

I have recently launched a new django based api, and quite quickly, I started to receive INVALID_HOST_HEADER SOME RANDOM URL errors. My understanding is that this is caused by somebody manually ...
Alex's user avatar
  • 205
1 vote
1 answer
736 views

Would HTTP Header injection allow for an XSS vulnerability if content-type is application/force-download?

I am currently conducting a pentest and I found an application vulnerable to http header injection, where the user input is reflected after the Content-Type header, and the Content-Type is set to ...
securitymensch's user avatar
1 vote
0 answers
136 views

Varnish website with authentication returning 200 when host header set to "#"

So I am testing a website that runs on Varnish and has HTTP authentication. Typically, if you try to visit the site, it prompts you for a username and password and if you enter it incorrectly/close ...
Jack's user avatar
  • 501
2 votes
2 answers
3k views

Flow of a host header injection attack?

I am new to this field and would like to know how the flow happens in a host header injection attacks. I believe it's as below: Client generates the request. Attacker manipulates the request and ...
pratik pattanaik's user avatar
1 vote
2 answers
7k views

Host header injection attack with Spring boot embedded tomcat

Our application has been checked by PEN Test tool, and there are description of issue: An attacker can redirect the application using the host header on the below mentioned URL to redirect them ...
dmitry's user avatar
  • 21
2 votes
0 answers
8k views

Prevention of host header injection in ASP.NET?

How can we mitigate host header injection in ASP.NET? I have already configured application binding in IIS and set static hostname but still, the vulnerability exists.
codeur's user avatar
  • 601
3 votes
1 answer
2k views

Is host header injection possible without cache or password reset?

I am a beginner in security and reading about host header injection. I tested an application for this vulnerability and it is possible there for some request, but the developer implemented no-cache, ...
Pawan Dwivedee's user avatar