> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/bug-bounty-methodology/host-header-injection.md).

# host-header-injection

Test All these on your sudomains lil bro,

### Basic Host Header Injection

```bash
curl -I https://TARGET -H "Host: evil.com"
```

### X-Forwarded-Host Injection

```bash
curl -I https://TARGET -H "X-Forwarded-Host: evil.com"
```

### X-Host Header Injection

```bash
curl -I https://TARGET -H "X-Host: evil.com"
```

### X-Forwarded-Server Injection

```bash
curl -I https://TARGET -H "X-Forwarded-Server: evil.com"
```

### X-HTTP-Host-Override

```bash
curl -I https://TARGET -H "X-HTTP-Host-Override: evil.com"
```

### Forwarded Header (RFC 7239)

```bash
curl -I https://TARGET -H "Forwarded: host=evil.com"
```

### Forwarded Header with Proto

```bash
curl -I https://TARGET -H "Forwarded: proto=https;host=evil.com"
```

### X-Forwarded-For + Host Combo

```bash
curl -I https://TARGET -H "X-Forwarded-For: 127.0.0.1" -H "Host: evil.com"
```

### Multiple Host Headers (Duplicate)

```bash
curl -I https://TARGET -H "Host: TARGET" -H "Host: evil.com"
```

### Host + X-Forwarded-Host Combo

```bash
curl -I https://TARGET -H "Host: TARGET" -H "X-Forwarded-Host: evil.com"
```

### Absolute URL in Host Header

```bash
curl -I https://TARGET -H "Host: https://evil.com"
```

### Host Header with Port

```bash
curl -I https://TARGET -H "Host: evil.com:443"
```

### Host Header with Trailing Dot

```bash
curl -I https://TARGET -H "Host: evil.com."
```

### Host Header with Subdomain Injection

```bash
curl -I https://TARGET -H "Host: evil.com.target.com"
```

### Host Header with @ Injection

```bash
curl -I https://TARGET -H "Host: evil.com@target.com"
```

### Host Header CRLF Injection (If HTTP/1.1)

```bash
curl -I https://TARGET -H $'Host: evil.com\r\nX-Test: injected'
```

### Web Cache Poisoning via Host Header

```bash
curl -I https://TARGET -H "Host: evil.com" -H "X-Forwarded-Host: evil.com"
```

### Origin Header Injection (CORS related)

```bash
curl -I https://TARGET -H "Origin: https://evil.com"
```

### Referer Based Host Confusion

```bash
curl -I https://TARGET -H "Referer: https://evil.com"
```

### Host Header in POST Request

```bash
curl -X POST https://TARGET -H "Host: evil.com" -d "test=test"
```

### HTTP/1.1 Forced Host Test

```bash
curl -I --http1.1 https://TARGET -H "Host: evil.com"
```

### Proxy Style Host Injection

```bash
curl -I https://TARGET -H "X-Original-Host: evil.com"
```

### Success Indicators (What to Look For)

```
Location: https://evil.com
Absolute links pointing to evil.com
Password reset links using evil.com
Cache poisoning persistence
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/bug-bounty-methodology/host-header-injection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.