2022 Developer Survey is open! Take survey.

Questions tagged [host-header-injection]

Host header injection is an attack that fools the victim server to echo an incorrect host header.

Filter by
Sorted by
Tagged with
1 vote
1 answer
26 views

To what attacks is using the value of the HOST header to craft self-referential URLs vulnerable?

From official ASP.NET Core docs, namely Routing in ASP.NET Core § URL generation concepts: Use GetUri* extension methods with caution in an app configuration that doesn't validate the Host header of ...
user avatar
  • 5,587
-2 votes
1 answer
31 views

CORS attack using authentication token [closed]

I found a website which is vulnerable to cors.(https://portswigger.net/web-security/cors) GET /api/requestApiKey HTTP/1.1. Host: vulnerable-website.com. Origin: https://evil.com. AUTHENTICATION: ...
user avatar
1 vote
2 answers
138 views

Do relative paths mitigate HTTP Host Header attacks?

I have been researching http host header attacks. There are many examples such as <a href="https://_SERVER['HOST']/support">Contact support</a>. Why would anyone use an absolute ...
user avatar
0 votes
1 answer
387 views

How could someone exploit a host header injection vulnerability that only effects the responses Location header?

If I go to the http site e.g. http://www.example.com the site will redirect (code 301) to the https version https://www.example.com. On various pentests I observed that if I modify the Host header in ...
user avatar
0 votes
1 answer
118 views

Can Proxy insert headers to a HTTPS requests which are on the same network?

I was reading about host header injection and found many reports on hackerone. Assume that if you inject X-Forwarded-Host header to specific requests, you may cause a redirect which can impact the ...
user avatar
  • 23
2 votes
1 answer
125 views

Arbitrary query parameter reflected in server response header. Is it exploitable?

SCENARIO: If I send requests like these: http://site.com/page?safe_param=1?my_arbitrary_param=2 The server responds with a normal HTTP response but within common headers it includes also the ...
user avatar
  • 477
3 votes
2 answers
342 views

Why do Invalid Host header errors exist, what are attackers trying to achieve?

I have recently launched a new django based api, and quite quickly, I started to receive INVALID_HOST_HEADER SOME RANDOM URL errors. My understanding is that this is caused by somebody manually ...
user avatar
  • 185
1 vote
1 answer
412 views

Would HTTP Header injection allow for an XSS vulnerability if content-type is application/force-download?

I am currently conducting a pentest and I found an application vulnerable to http header injection, where the user input is reflected after the Content-Type header, and the Content-Type is set to ...
user avatar
1 vote
0 answers
61 views

Varnish website with authentication returning 200 when host header set to "#"

So I am testing a website that runs on Varnish and has HTTP authentication. Typically, if you try to visit the site, it prompts you for a username and password and if you enter it incorrectly/close ...
user avatar
  • 461
2 votes
2 answers
2k views

Flow of a host header injection attack?

I am new to this field and would like to know how the flow happens in a host header injection attacks. I believe it's as below: Client generates the request. Attacker manipulates the request and ...
user avatar
0 votes
2 answers
3k views

Host header injection attack with Spring boot embedded tomcat

Our application has been checked by PEN Test tool, and there are description of issue: An attacker can redirect the application using the host header on the below mentioned URL to redirect them ...
user avatar
  • 11
0 votes
0 answers
5k views

Prevention of host header injection in ASP.NET?

How can we mitigate host header injection in ASP.NET? I have already configured application binding in IIS and set static hostname but still, the vulnerability exists.
user avatar
  • 581
3 votes
1 answer
1k views

Is host header injection possible without cache or password reset?

I am a beginner in security and reading about host header injection. I tested an application for this vulnerability and it is possible there for some request, but the developer implemented no-cache, ...
user avatar