Host Header Attacks
Possible attack vectors
Check for flawed validation
GET /example HTTP/1.1
Host: vulnerable-website.com:bad-stuff-hereGET /example HTTP/1.1
Host: hacked-subdomain.vulnerable-website.comSend ambigious requests
GET /example HTTP/1.1
Host: vulnerable-website.com
Host: bad-stuff-hereGET https://vulnerable-website.com/ HTTP/1.1
Host: bad-stuff-hereGET /example HTTP/1.1
Host: bad-stuff-here
Host: vulnerable-website.comPotential Headers to inject
Lab: Basic password reset poisoning
First, we will trigger the password reset.
After studying the flow, we realised that if we change the Hostvalue, the URL in the email will change accordingly.
So we just need to change the Hostvalue to the exploit server and the username to carlos
We should be able to see the token value in the access log
We can change the password using the token we got for carlos.
Lab: Web cache poisoning via ambiguous requests
Update the exploit server to contain this:
Spam this request to keep the cache poisoned
Lab: Host header authentication bypass
Change the value of Hostto localhost to access the admin panel
After which, change the path to delete carlos
First, we will try to see does it send anything to the collaborator
We can see that it does send to the collaborator
So, the next step we need to see which IP address is able to access the admin page.
By using intruder, we will replace the value in the Hostheader with the IP addresses.
We also need to ensure that the Update Host header to match target is not checked.
After running the intruder, we can see that got 1 IP address that returns a 302 status code.
After modifying the request, we are able to visit the admin panel
If we try to modify the Hostheader directly, we will get blocked.
If we put an abosolute URL in the request, we can see that the request goes through as per normal.
So, we will try to put our collaborator payload into the Hostheader
We can see that the request went through, this means that the checks is being done on the URL instead.
Same as the previous lab, change the value in the Hostheader to be a IP address and use intruder to scan through all of it. Need to uncheck the Update Host header to match target
After running the scan, we can see that the IP address that returns a status code of 302 is 50
After modifying the request to go /admin, we can see the admin panel
Lastly, to delete carlos, just need to send this modified POST request
Lab: Host validation bypass via connection state attack
If we change the Hostheader to 192.168.0.1and the route to /admin, we can see that we are being redirected
What we can do is send 1 legitimate request and 1 malicious request using the same connection
We can see that the 2nd request is able to see the admin panel.
To delete the account, just need to modify the request to delete it and resend the sequence using the same connection
Last updated