Host header attacks
Last updated
Last updated
Heavily inspired by
Send an arbitrary host header and see if you can still reach the app
If port is not checked, and non-numeric port can be supplied
If subdomains are not checked properly Register a domain that ends with the same name as the target one
Already compromised subdomain
If the different components of the app use different validation logic, you may be able to exploit that.
Duplicate host headers
Line wrappings (if just duplicating the host header gets blocked, try to indent one)
Absolute URL
Using X-Forwarded-Host, X-Host, X-Forwarded-Server, X-HTTP-Host-Override or Forwarded header
Manipulate a website into generating a password reset link pointing to a domain under the your control
Ensure Burp is enabled (to record the http history)
Do the whole password reset procedure once with your own account
Check Burp's HTTP history and look for the request, that triggered the reset, send to Repeater
Change the Host header* and resend the request
Check if the password reset still works, and if the reset link in the email contains the modified host
* If you can't change the Host header, try other stuff like using X-Forwarded-Host header to inject your host. (see above)
Normally reflected Host headers are not exploitable, but when they're returned in a cached response, we may be able to leverage this for client side attacks like XSS.
Try to observe differences between initial and further (cached) requests, use a "cache buster" like appending a get parameter (e.g. ?asdf=1) to get a fresh, uncached request, just change the the param.
See if any of the above vulnerabilities can be used in a cached response (and therefore enable you to target other users, e.g. using XSS)
If the Host header is used for access control, e.g. using localhost to access an admin panel, this may be exploited, by just changing the Host header accordingly and get access.
Using Burp Collaborator, placing it's url into the Host header, you can check if the app reaches out to it. If so, in the next step you can use private IP addresses in the Host header to try to access internal-only systems. If you don't already have discovered private internal IP addresses, you can try to brute-force standard private IP ranges using e.g. Burp Intruder.
For more:
See also
See also
See also
See also
See also