hunt-host-header

1# HUNT-HOST-HEADER — Host Header Injection
2 
3## Grounding / Provenance
4 
5This skill is built from the public Host-header attack literature, not invented payloads.
6Cite the *technique source* in your report, never a fabricated ID:
7 
8- **Password-reset poisoning class** — the canonical write-up is Skelet's/Detectify-era
9  "Practical HTTP Host header attacks" (the Django `request.get_host()` → password-reset-link
10  case). Many frameworks built the reset URL from the request Host with no `ALLOWED_HOSTS`-style
11  allowlist. Cite the framework + the reflected-Host behaviour you actually observed.
12- **Web cache poisoning via unkeyed Host / X-Forwarded-Host** — PortSwigger Research,
13  James Kettle, "Practical Web Cache Poisoning" (2018) and "Web Cache Entanglement" (2020).
14  These define unkeyed-input poisoning, which is the mechanism behind X-Forwarded-Host poisoning.
15- **Routing-based SSRF** — PortSwigger Research, "Cracking the lens" / routing-based SSRF
16  (Host header steers the front-end's upstream selection).
17 
18When you write the report, name the exact behaviour you reproduced (reflected header, cache HIT
19on a fresh key, OOB hit from your Collaborator). Do **not** copy a CVE or H1 ID you have not
20verified — a missing citation is always better than a wrong one.
21 
22---
23 
24## Crown Jewel Targets
25 
26Host header injection that reaches password reset links = Critical (ATO for any user).
27 
28**Highest-value chains:**
29…