CWE-644: Improper Neutralization of HTTP Headers
Last updated 10 months ago
Was this helpful?
Web cache poisoning via ambiguous requests
Password reset poisoning
Add two HOST: in Request.
HOST:
Try localhost
Try this Headers
If you come across /api.json in any AEM instance during bug hunting, try for web cache poisoning via followingHost: , X-Forwarded-Server , X-Forwarded-Host: and or simply try https://localhost/api.json HTTP/1.1
/api.json
Host: , X-Forwarded-Server , X-Forwarded-Host:
Also try Host: redacted.com.evil.com
Host: redacted.com.evil.com
Try Host: evil.com/redacted.com https://hackerone.com/reports/317476
Try this too Host: example.com?.mavenlink.com
Host: example.com?.mavenlink.com
Try Host: javascript:alert(1); Xss payload might result in debugging mode. https://blog.bentkowski.info/2015/04/xss-via-host-header-cse.html
Host: javascript:alert(1);
Host Header to Sqli https://blog.usejournal.com/bugbounty-database-hacked-of-indias-popular-sports-company-bypassing-host-header-to-sql-7b9af997c610
Bypass front server restrictions and access to forbidden files and directories through
Add line wrapping
Supply an absolute URL
Web cache poisoning
Exploiting classic server-side vulnerabilities
Bypassing authentication
Virtual host brute-forcing
Routing-based SSRF
Connection state attacks
PortSwigger
