Host Header & Password Reset Poisoning
If the app builds absolute URLs from the request Host, reset mails and caches become ATO.
Tags: host-header, ato, cache
Level: intermediate
Method
Find absolute URL builders
Password reset, invites, magic links, OG tags, sitemaps, asset prefixes.
Tools: Burp Suite
Inject Host variants
Host, X-Forwarded-Host, Forwarded, X-Forwarded-Server, duplicate Host. Watch the email and the HTML.
Confirm delivery
The reset link in the mailbox (or the preview API) must point at you. A reflected Host in HTML is a cache gadget, not yet ATO.
Cache angle
If Host is unkeyed, you poison everyone. Second client must see the poisoned asset URLs.
Field notes
- Many frameworks ignore Host but honour X-Forwarded-Host behind a reverse proxy that trusts the client.
- Do not steal a real user's reset. Use two accounts you own.