domains / families / security / testing-for-host-header-injection

testing-for-host-header-injection

separate

Test web applications for HTTP Host header injection vulnerabilities

When to use

• When testing password reset functionality for token theft via host manipulation
• During assessment of web caching behavior influenced by Host header values
• When testing virtual host routing and server-side request processing
• During penetration testing of applications behind reverse proxies or load balancers
• When evaluating SSRF potential through Host header manipulation

Skill page

Source