Agent skill · security · yaklang
http-host-header-attacks
HTTP Host header injection and routing abuse playbook. Use when the application trusts the Host header for generating URLs, routing requests, or access control — enabling password reset poisoning, web cache poisoning, SSRF via routing, and virtual host bypass.
Why this skill is useful
Adds detailed attack vectors and testing procedures for Host header injection that are not commonly known or documented.
What it needs
About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: HTTP Host Header Attacks — Injection & Routing Abuse AI LOAD INSTRUCTION: Covers Host header injection for password reset poisoning, cache poisoning, SSRF via routing, and virtual host bypass. Includes bypass techniques for Host validation and framework-specific behaviors. Base models often miss the double-Host trick, absolute-URI override, and connection-state attacks. 0. RELATED ROUTING web-cache-deception when Host injection is combined with cache behavior ssrf-server-side-request-forgery when Host header routes requests to internal services open-redirect when Host injection causes redirect to attacker domain waf-bypass-techniques when Host manipulation helps bypass WAF routing request-smuggling when smuggling enables Host header manipulation past front-end validation subdomain-takeover when Host routing exposes internal vhosts resolvable via subdomain --- 1. ATTACK SURFACE The Host header is used by web applications and infrastructure for: Usage Exploitation --- --- URL generation (password reset links, email links) Inject attacker domain → user clicks link to attacker Virtual host routing Spoof Host → access internal/admin vhost Cache key component Inject different Host → poison cache for all users Reverse proxy routing Host determines backend → SSRF to internal services Access control decisions Host-based ACLs can be bypassed Canonical URL / SEO redirects Host injection → open redirect --- 2. PASSWORD RESET POISONING The most common and impactful Host header attack. How It Works Testing Check Burp Collaborator for incoming HTTP request with the reset token. Variants Some apps concatenate: Host: target.com.attacker.com → link becomes https://target.com.attacker.com/reset?token=xxx Some apps use only the port portion: Host: target.com:@attacker.com → parsed as attacker.com in some URL parsers --- 3. WEB CACHE POISONING VIA HOST Key requirement: Cache must not include Host header in cache key, but application must use Host in response body. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/http-host-header-attacks