Day 25 Bug Bounty — Host Header Injection Attacks 2026

How Host Header Injection Works

The HTTP Host header tells the server which virtual host is being addressed — in a shared hosting environment, dozens of domains may point to the same IP, and the Host header determines which application handles the request. In theory, the server knows its own domain and should validate the Host header against it. In practice, many applications use the Host header value directly in their business logic: constructing password reset URLs, building canonical links, routing to backend services, or setting cache keys.

The attacker’s leverage is control over this header. In normal browser traffic, the browser sets the Host header to the domain in the URL and you can’t change it. In Burp Suite’s intercept proxy, you can modify any header before it reaches the server. An application that uses Host to construct a password reset link without validation will happily include your attacker-controlled domain in that link, send it to the victim’s email, and not know anything went wrong.

Password Reset Poisoning — Full Attack Chain

Password reset poisoning is the cleanest, most directly reportable variant of Host header injection. The attack chain is: attacker initiates password reset for victim account → modifies Host header to attacker-controlled domain → application generates reset token and sends reset email to victim with attacker’s domain in the link → victim clicks what appears to be a legitimate reset email → attacker’s server receives the reset token → attacker uses token to set new password and owns the account.

The beauty of this attack from a bug bounty perspective is the clear, demonstrable impact. You don’t need to guess whether it’s exploitable — you can demonstrate the full chain using test accounts and Burp Collaborator without touching any real user. The severity is unambiguously Critical when the chain results in complete account takeover.

Bypass Headers — When Direct Injection Fails

Many applications validate the Host header — checking that it contains their domain or matches a whitelist. When direct Host modification fails, I move to bypass headers. The most effective is X-Forwarded-Host — a proxy header that many applications accept as an override for the actual Host value, often without the same validation applied to the Host header itself. Some applications strip X-Forwarded-Host but accept X-Host, Forwarded, or X-Original-Host.

The validation bypass techniques are equally important. Applications that check whether the Host header contains their domain can be bypassed with Host: target.com@attacker.com or Host: attacker.com#target.com. The application’s string matching finds “target.com” in the header, but the URL construction uses the full value — routing the generated link to the attacker’s domain.

Web Cache Poisoning via Host Header

Web cache poisoning via Host header is the variant with the highest potential scale. Instead of affecting one user’s password reset, a successful cache poisoning attack delivers a poisoned response to every user who requests the cached endpoint. If the Host header is included in the response (as an absolute URL, a script source, or a canonical tag) but not in the cache key, an attacker can send a poisoned request that gets cached and served to all subsequent visitors.

Testing cache poisoning safely requires cache busters — unique parameter values appended to the URL that prevent your poisoned response from being served to real users during testing. Always test cache poisoning with a cache buster parameter first to confirm the vulnerability without polluting real cached responses.

Writing the Bug Bounty Report

Host header injection reports follow a clear structure: the specific vulnerable endpoint, the exact header modification, the impact chain demonstrated, and the suggested remediation. For password reset poisoning, the impact chain is explicit — demonstrate that a victim’s reset token can be captured and used for account takeover, using your own test accounts only. Never attempt to capture another user’s real reset token.