vulns.cofield index
Enter
Contribute
Payload class · host

Host Header Injection

Poison password-reset links and cache keys by overriding the Host the app trusts. Prime targets: reset emails, absolute URL generation, and unkeyed cache inputs.

host-headerpassword-resetcache
Stable IDpayload:host-headerLast updatedLast verifiedLegacy review pendingProvenanceSource-linked
Context first

Use as a detection primitive

Poison password-reset links and cache keys by overriding the Host the app trusts. Prime targets: reset emails, absolute URL generation, and unkeyed cache inputs.

Do not copy blind

Identify the parser, sink, encoding, and expected non-vulnerable behavior before choosing a sample. Prefer non-destructive markers.

Samples

Recorded payloads

Detection sampleAuthorization required

Confirm the sink and encoding context before use.

Host: evil.com
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

X-Forwarded-Host: evil.com
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

X-Forwarded-Server: evil.com
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

X-Host: evil.com
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Detection sampleAuthorization required

Confirm the sink and encoding context before use.

Host: target.com\r\nX-Forwarded-Host: evil.com
Positive signal
Tool-specific output that supports the stated hypothesis.
Negative control
No result, or identical behavior against a known-safe control.
Intrusiveness
Review flags and target scope before execution.
Source

Attribution

Open the primary collection ↗

Version history: normalized permanent page created 2026-08-20.