Find Host header flaws in your web application.
What it does
Guides testing of web applications for Host header injection, poisoned reset links, cache poisoning, and routing bypasses.
When to use it
Use when an application trusts the Host header to generate URLs, route requests, or make access-control decisions.
How to use it
Give it a target application; it checks Host header manipulation for observable injection and routing vulnerabilities.
What you provide
- the target application
Uses
Good to know
- cannot be undone: target web application
Latest review
What you need · 3
Uses ffuf to brute-force virtual-host names against the target IP.
Requires Burp Repeater connection reuse for the prescribed manual connection-state testing.
Access · 3
This skill
target web application
Write
Requests poisoned password reset emails (irreversible)
internal services
Read
Probes internal services through routing