Hunt Host Header
Hunt Host Header Injection, password reset poisoning → ATO, web cache poisoning via...
Install
npx skills add elementalsouls/Claude-BugHunter --skill hunt-host-header -g -a claude-code -y- Repository
- elementalsouls/Claude-BugHunter5.4k
- Category
- Writing
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunt Host Header Injection, password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Built on public Host-header research (PortSwigger 'Practical web cache poisoning' + James Kettle, and the classic password-reset-poisoning class). Use on any forgot-password flow, CDN/reverse-proxy-fronted app, OAuth/OIDC endpoint, or absolute-URL-in-email feature.
HUNT-HOST-HEADER, Host Header Injection
Grounding / Provenance
This skill is built from the public Host-header attack literature, not invented payloads. Cite the technique source in your report, never a fabricated ID:
- Password-reset poisoning class, the canonical write-up is Skelet's/Detectify-era
"Practical HTTP Host header attacks" (the Django
request.get_host()→ password-reset-link case). Many frameworks built the reset URL from the request Host with noALLOWED_HOSTS-style allowlist. Cite the framework + the reflected-Host behaviour you actually observed. - Web cache poisoning via unkeyed Host / X-Forwarded-Host, PortSwigger Research, James Kettle, "Practical Web Cache Poisoning" (2018) and "Web Cache Entanglement" (2020). These define unkeyed-input poisoning, which is the mechanism behind X-Forwarded-Host poisoning.
- Routing-based SSRF, PortSwigger Research, "Cracking the lens" / routing-based SSRF (Host header steers the front-end's upstream selection).
When you write the report, name the exact behaviour you reproduced (reflected header, cache HIT on a fresh key, OOB hit from your Collaborator). Do not copy a CVE or H1 ID you have not verified, a missing citation is always better than a wrong one.
Crown Jewel Targets
Host header injection that reaches password reset links = Critical (ATO for any user).
