What problem does it solve? Web applications and proxies often trust the HTTP Host header for URL generation, routing, caching, and access control, and this Skill provides a systematic playbook to identify and exploit that trust during authorized penetration tests and CTF engagements. ## Core Features & Use Cases - Password Reset Poisoning: Inject an attacker-controlled Host header into reset requests so recovery links leak tokens to a collaborator endpoint. - Cache Poisoning & SSRF via Routing: Detect caches that omit Host from the cache key and reverse proxies that route requests to internal backends based on Host. - Validation Bypass Techniques: Apply X-Forwarded-Host overrides, absolute-URI request lines, double Host headers, trailing dots, URL parser confusion, and connection-state attacks when Host is validated. - Use Case: During a web app assessment, you find the forgot-password endpoint reflects the Host header; follow the playbook to confirm token leakage via Burp Collaborator, then escalate with framework-specific bypasses for Django, Rails, PHP, or Express. ## Quick Start Use the http-host-header-attacks skill to test the target's password reset endpoint for Host header injection and try validation bypasses if the header is filtered.
