HTTP Host header attacks

A person who receives and entertains guests.

Theory

HTTP Host header identifies which back-end component the client wants to communicate with. In the following image, you can observe accessing internal resources by sending a request with a changed value of the Host header.

https://portswigger.net/web-security/host-header

Methodology

Identification

1. Modify the Host header and analyze the response
   a) Access the landing page — examine processing of Host header
   b) Get an error (invalid Host header) — content reflection or move on
2. Check for faulty validation
   a) Specify port (also in non-numeric form)
   b) Add “not” before the value
   c) Use a less secure subdomain
3. Send ambiguous requests
   a) Add a duplicate Host header
   b) Specify the absolute URL after the method and manipulate the value of the Host header
   c) Add line wrapping (Tab key after first or second Host header)
4. Inject host override headers
   a) X-Forwarded-Host, X-Host, X-Forwarded-Server, X-HTTP-Host-Override, Forwarded
   b) Use Param Miner’s “Guess headers” function

Exploitation

1. Password reset poisoning
   a) Use the techniques mentioned above in the password reset process
   b) Have the password reset token sent to the server you control
2. Web cache poisoning via the Host header
   a) Notice the verbose caching headers
   b) Try the above identification techniques
   c) Spot if the Host header is reflected in a file import
3. Try SQLi probing techniques in Host header.
4. Access internal resources
   a) Modify the Host header’s value to 127.0.0.1 or localhost
   b) Brute-force virtual hosts
5. Test for routing-based SSRF
   a) Insert Collaborator URL in the Host header
6. Perform connection state attack
   a) Send two requests in the same connection (Group functionality in Burp Repeater)
   b) 1st request —legit, 2nd request — malicious
7. Start the path with the @ sign
   a) GET @private-intranet/example HTTP/1.1