search

Host Header Injection

hashtag
Introduction

HTTP Host header attacks exploit vulnerable websites that handle the value of the Host header in an unsafe way. If the server implicitly trusts the Host header, and fails to validate or escape it properly, an attacker may be able to use this input to inject harmful payloads that manipulate server-side behavior. Attacks that involve injecting a payload directly into the Host header are often known as "Host header injection" attacks.

hashtag
Where to find

In the feature where the website can send email to us. For example forgot password / newsletter.

hashtag
How to exploit

  1. Change the host header

GET /index.php HTTP/1.1
Host: evil-website.com
...

  1. Duplicating the host header

GET /index.php HTTP/1.1
Host: vulnerable-website.com
Host: evil-website.com
...

  1. Add line wrapping

  1. Add host override headers

How to use? In this case im using "X-Forwarded-For : evil.com"

  1. Supply an absolute URL

hashtag
References

PreviousExposed Source CodeNextInsecure Direct Object Reference (IDOR)

Last updated