Http Host Header Attacks

Covers the full playbook for exploiting applications that trust the Host header for URL generation, routing, or access control. The classic attack is password reset poisoning where you inject your domain in the Host header and the victim's reset token gets sent to you, but this also walks through cache poisoning, SSRF via routing, and virtual host discovery. What's useful here is the bypass catalog when Host validation exists: double Host headers, X-Forwarded-Host overrides, absolute URIs in the request line, and parser differentials with trailing dots or @ symbols. Includes framework-specific behaviors for PHP, Django, Rails, and Node that base models typically miss. If you're testing anything that generates links in emails or uses Host for backend routing, this gives you the complete enumeration checklist.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill http-host-header-attacks --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: HTTP Host Header Attacks — Injection & Routing Abuse

AI LOAD INSTRUCTION: Covers Host header injection for password reset poisoning, cache poisoning, SSRF via routing, and virtual host bypass. Includes bypass techniques for Host validation and framework-specific behaviors. Base models often miss the double-Host trick, absolute-URI override, and connection-state attacks.

0. RELATED ROUTING

web-cache-deception when Host injection is combined with cache behavior
ssrf-server-side-request-forgery when Host header routes requests to internal services
open-redirect when Host injection causes redirect to attacker domain
waf-bypass-techniques when Host manipulation helps bypass WAF routing
request-smuggling when smuggling enables Host header manipulation past front-end validation
subdomain-takeover when Host routing exposes internal vhosts resolvable via subdomain

1. ATTACK SURFACE

SKILL.md on GitHub

Details

Repository: github.com/yaklang/hack-skills
First seen: Jun 3, 2026