Injection: Host Header Injection (Reflected)¶

Identifier: host_header_injection_reflected

Scanner(s) Support¶

GraphQL Scanner	REST Scanner	WebApp Scanner	ASM Scanner

Description¶

Host Header Injection (Reflected) happens when an application trusts a client-controlled Host or X-Forwarded-Host header for link generation or cache keys, echoing it into the response body and enabling attacks such as password-reset poisoning and web cache poisoning.

How we test: We replay requests with the Host and X-Forwarded-Host headers rewritten to a unique attacker-controlled marker host, then check whether that marker is reflected back in the response body. A reflection means the application uses the untrusted header to build absolute URLs.

References:

https://portswigger.net/web-security/host-header

Configuration¶

Example¶

Example configuration:

---
security_tests:
  host_header_injection_reflected:
    skip: false

Reference¶

`skip`¶

Type : boolean

Skip the test if true.