domains / families / security / http-host-header-attacks

http-host-header-attacks

separate

HTTP Host header injection and routing abuse playbook. Use when the application trusts the Host header for generating URLs, routing requests, or access control — enabling password reset poisoning, web cache poisoning, SSRF via routing, and virtual host bypass.

When to use

• password reset poisoning
• web cache poisoning
• SSRF via routing
• virtual host bypass
• Host validation bypass
• framework-specific behaviors

Skill page

Source