Questions tagged [host-header-injection]
Host header injection is an attack that fools the victim server to echo an incorrect host header.
13
questions
1
vote
1
answer
26
views
To what attacks is using the value of the HOST header to craft self-referential URLs vulnerable?
From official ASP.NET Core docs, namely Routing in ASP.NET Core § URL generation concepts:
Use GetUri* extension methods with caution in an app configuration that doesn't validate the Host header of ...
- 5,587
-2
votes
1
answer
31
views
CORS attack using authentication token [closed]
I found a website which is vulnerable to cors.(https://portswigger.net/web-security/cors)
GET /api/requestApiKey HTTP/1.1.
Host: vulnerable-website.com.
Origin: https://evil.com.
AUTHENTICATION: ...
1
vote
2
answers
138
views
Do relative paths mitigate HTTP Host Header attacks?
I have been researching http host header attacks. There are many examples such as <a href="https://_SERVER['HOST']/support">Contact support</a>. Why would anyone use an absolute ...
0
votes
1
answer
387
views
How could someone exploit a host header injection vulnerability that only effects the responses Location header?
If I go to the http site e.g. http://www.example.com the site will redirect (code 301) to the https version https://www.example.com.
On various pentests I observed that if I modify the Host header in ...
- 13
0
votes
1
answer
118
views
Can Proxy insert headers to a HTTPS requests which are on the same network?
I was reading about host header injection and found many reports on hackerone.
Assume that if you inject X-Forwarded-Host header to specific requests, you may cause a redirect which can impact the ...
- 23
2
votes
1
answer
125
views
Arbitrary query parameter reflected in server response header. Is it exploitable?
SCENARIO:
If I send requests like these:
http://site.com/page?safe_param=1?my_arbitrary_param=2
The server responds with a normal HTTP response but within common headers it includes also the ...
- 477
3
votes
2
answers
342
views
Why do Invalid Host header errors exist, what are attackers trying to achieve?
I have recently launched a new django based api, and quite quickly, I started to receive INVALID_HOST_HEADER SOME RANDOM URL errors. My understanding is that this is caused by somebody manually ...
- 185
1
vote
1
answer
412
views
Would HTTP Header injection allow for an XSS vulnerability if content-type is application/force-download?
I am currently conducting a pentest and I found an application vulnerable to http header injection, where the user input is reflected after the Content-Type header, and the Content-Type is set to ...
1
vote
0
answers
61
views
Varnish website with authentication returning 200 when host header set to "#"
So I am testing a website that runs on Varnish and has HTTP authentication. Typically, if you try to visit the site, it prompts you for a username and password and if you enter it incorrectly/close ...
- 461
2
votes
2
answers
2k
views
Flow of a host header injection attack?
I am new to this field and would like to know how the flow happens in a host header injection attacks.
I believe it's as below:
Client generates the request.
Attacker manipulates the request and ...
0
votes
2
answers
3k
views
Host header injection attack with Spring boot embedded tomcat
Our application has been checked by PEN Test tool, and there are description of issue:
An attacker can redirect the application using the host header on the
below mentioned URL to redirect them ...
- 11
0
votes
0
answers
5k
views
Prevention of host header injection in ASP.NET?
How can we mitigate host header injection in ASP.NET? I have already configured application binding in IIS and set static hostname but still, the vulnerability exists.
- 581
3
votes
1
answer
1k
views
Is host header injection possible without cache or password reset?
I am a beginner in security and reading about host header injection. I tested an application for this vulnerability and it is possible there for some request, but the developer implemented no-cache, ...