Questions tagged [host-header-injection]

Host header injection is an attack that fools the victim server to echo an incorrect host header.

Filter by
Sorted by
Tagged with
1
vote
0answers
24 views

Varnish website with authentication returning 200 when host header set to “#”

So I am testing a website that runs on Varnish and has HTTP authentication. Typically, if you try to visit the site, it prompts you for a username and password and if you enter it incorrectly/close ...
1
vote
2answers
588 views

Flow of a host header injection attack?

I am new to this field and would like to know how the flow happens in a host header injection attacks. I believe it's as below: Client generates the request. Attacker manipulates the request and ...
0
votes
1answer
909 views

Host header injection attack with Spring boot embedded tomcat

Our application has been checked by PEN Test tool, and there are description of issue: An attacker can redirect the application using the host header on the below mentioned URL to redirect them ...
0
votes
0answers
2k views

Prevention of host header injection in ASP.NET?

How can we mitigate host header injection in ASP.NET? I have already configured application binding in IIS and set static hostname but still, the vulnerability exists.
3
votes
1answer
1k views

Is host header injection possible without cache or password reset?

I am a beginner in security and reading about host header injection. I tested an application for this vulnerability and it is possible there for some request, but the developer implemented no-cache, ...