Host Header labs
Host Header Injection / Password Reset Poisoning
What is Host Header?
Host Header Injection abuses applications that trust the request's Host header (or X-Forwarded-Host). By manipulating it you poison the password-recovery link (the victim's token lands with the attacker), poison the cache with URLs toward your domain and, with certain proxies, force a routing-based SSRF.
Why practice Host Header?
Tons of apps build absolute links (reset, verification, invitations) from the request Host without validating it. It's an easy bug to test but high impact: password reset poisoning is direct account takeover. Typical bounties: $500-$8,000, and more if it escalates to routing-based SSRF.
What will you learn with the Host Header labs?
You'll learn to manipulate the Host and its proxy variants, detect where it's reflected or used to generate URLs, poison the reset link to steal the victim's token, poison the cache with an unexpected Host, and force SSRF when the edge routing depends on the Host.
Types of Host Header we cover
- Password reset poisoning
The app builds the recovery link with the request Host. You change it to your domain and the victim's reset token ends up on your server.
- Cache poisoning via Host
The Host (or X-Forwarded-Host) reflects in the response and gets cached, serving your content, canonical or redirect to all users.
- Routing-based SSRF
A proxy or load balancer routes by Host; pointing it at an internal service forces the edge to talk to private resources.
- Web cache / unexpected domain
An unexpected Host makes the back-end generate absolute URLs, canonical tags or scripts pointing at your domain.
How do you find and exploit Host Header?
A practical playbook — from recon to proof of concept.
- 1
Manipulate the Host and its variants
Change the Host header and try X-Forwarded-Host, X-Host and X-Forwarded-Server. Watch whether the value ends up reflected or used to build links.
Host: evil.com · X-Forwarded-Host: evil.com - 2
Detect where the Host is used
Look for responses that reflect your Host (canonical, scripts, redirects) or functions that generate absolute URLs with it (emails, links).
<link rel=canonical href="https://evil.com/..."> · Location: https://evil.com/... - 3
Poison the reset link
Request a password reset for one of your accounts with a malicious Host and check whether the email link points to your domain.
POST /forgot-password Host: evil.com body: email=me@x.com → link: https://evil.com/reset?token=... - 4
Steal the victim's token
If it works, repeat it against the victim's account: when they request a reset, their token travels to your server and you take over their account.
evil.com log: GET /reset?token=VICTIM_TOKEN - 5
Force routing-based SSRF
If a proxy routes by Host, point it at localhost or cloud metadata to reach internal services from the edge.
Host: 169.254.169.254 · Host: localhost
Loading labs...
View in full catalog →Frequently asked questions
What is Host Header Injection?
It's a vulnerability where the application trusts the request's Host header (or X-Forwarded-Host) to build URLs, route or cache. By manipulating it, the attacker diverts links toward their domain, poisons the cache or forces the server to talk to internal resources.
How is password reset poisoning exploited?
You request a password reset sending a malicious Host or X-Forwarded-Host. If the app builds the recovery link with that value, the victim's email will contain a URL toward the attacker's domain; when the victim (or a pre-fetch) opens the link, the reset token leaks and the account is taken over.
How do you find Host Header Injection in bug bounty?
Resend requests changing the Host and adding X-Forwarded-Host, and watch whether the value reflects in the response or in the generated links. The most valuable target is the password reset flow: request a reset with a malicious Host and check which domain the email link points to.
How do you prevent Host Header Injection?
Don't build URLs from the request Host: use a canonical domain configured on the server. Validate the Host against an allowlist, ignore untrusted proxy headers (X-Forwarded-Host) unless behind a trusted proxy, and generate reset links with a fixed absolute base.
Difference between Host Header Injection and SSRF?
Host Header Injection manipulates the Host header to poison links, cache or routing. When the edge routes by Host and you point it at an internal address, that specific case becomes a routing-based SSRF. Generic SSRF, by contrast, abuses a feature that fetches a URL you control, not the Host.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Host Header in real labs
Every Host Header lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime