| description | CWE-644: Improper Neutralization of HTTP Headers |
|---|
- Web cache poisoning via ambiguous requests
- Password reset poisoning
- Add two
HOST:in Request. - Try localhost
- Try this Headers
- If you come across
/api.jsonin any AEM instance during bug hunting, try for web cache poisoning via followingHost: , X-Forwarded-Server , X-Forwarded-Host:
and or simply try https://localhost/api.json HTTP/1.1 - Also try
Host: redacted.com.evil.com - Try Host: evil.com/redacted.com
https://hackerone.com/reports/317476 - Try this too
Host: example.com?.mavenlink.com - Try
Host: javascript:alert(1);Xss payload might result in debugging mode.
https://blog.bentkowski.info/2015/04/xss-via-host-header-cse.html - Host Header to Sqli
https://blog.usejournal.com/bugbounty-database-hacked-of-indias-popular-sports-company-bypassing-host-header-to-sql-7b9af997c610 - Bypass front server restrictions and access to forbidden files and directories through
- Add line wrapping
- Supply an absolute URL
- Add two
- Web cache poisoning
- Exploiting classic server-side vulnerabilities
- Bypassing authentication
- Virtual host brute-forcing
- Routing-based SSRF
- Connection state attacks