BSCPServer-side
Host header attacks
Outline only. The Host header is client-influenced, and some apps still use it to build links or pick a tenant.
8 min read · Academy topic: HTTP Host header attacks · Outline, not a finished note
Outline. This module is on the map so you can track it. The page below is a writing checklist, not finished study material.
Objectives
- Explain why Host is not a trustworthy source of the site's own name
- Connect password-reset links and caches to that mistake
TODO
Write the concept. Leave lab syntax in the Academy exercise.
Checklist
- The browser sends
Host. A proxy may also seeX-Forwarded-Host. Neither is proof of the name the application should call itself. - Password-reset and email links built from that header can point at a name the requester chose. The bug is the link builder.
- Virtual hosting and multi-tenant routing that trust the header can select the wrong site. The defender’s fix is a configured canonical name, not the request’s copy of it.
- Cache interaction belongs in the cache-poisoning outline.
- Lab work stays on the lab host. Rewriting Host against a real tenant is out of scope.
- Web cache poisoningOutline only. Cache poisoning is a shared cache storing a response that was varied by an unkeyed input.
- Authentication failuresPassword attacks are an economics problem. Online guessing, offline cracking, and reused passwords fail in different places, and the controls are different too.