Web Security
Host Header Attacks
The Host header tells the server which site you want. Many applications trust it blindly — using it to build password reset links, cache keys, and internal routing decisions. Poison it and you control the output.
Intermediate40 min7 lessons2 hands-on
First lesson free. The full module is part of Pro.
You'll be able to
- ✓Explain how the Host header is used in virtual host routing
- ✓Identify applications that use the Host header to build dynamic URLs
- ✓Execute a password reset poisoning attack to capture a victim's reset token
- ✓Abuse Host header manipulation for routing-based SSRF to internal services
- ✓Validate the Host header against an allowlist and build URLs from config