Every HTTP request carries a Host header — it tells a server which site you want when many sites share one IP address. It looks like plumbing, and that is exactly the trap: developers forget one basic fact.
**The Host header is supplied by the client. It is attacker-controlled.**Yet applications routinely trust it — they build absolute URLs from it, stamp it into password-reset emails, use it in cache keys, and route requests by it. When attacker-controlled input is trusted to make a security decision, you have a vulnerability.
What this lets an attacker do
- Password-reset poisoning — the classic, account-takeover-grade impact. Request a reset for the victim's account with a spoofed
Host, and the application mails the victim a reset link pointing at your server. The secret token leaks to you. - Reach an internal vhost — manipulate the
Hostto be routed to a staging site, an admin interface, or a backend not meant to be externally addressable. - Web cache poisoning / routing-based SSRF — when the spoofed host is reflected into a cached response or used to build an internal request.
The header that beats "we validate Host"
When an app sits behind a proxy or CDN, the proxy often forwards the original host in **X-Forwarded-Host*, and many frameworks prefer* it over Host. Unless the edge strips it, an attacker just sends their own — so even apps that check Host fall to an unvalidated X-Forwarded-Host.
In this lesson you will
- Understand why the
Hostheader is attacker-controlled yet trusted, and the sinks it flows into. - Walk through password-reset poisoning end to end.
- See how **
X-Forwarded-Host** and proxy trust extend the attack, and how it connects to cache poisoning and SSRF. - Send a spoofed
Host/X-Forwarded-Hostrequest against an authorised lab and observe how the app handles it. - Learn the durable fix — **never derive a URL from the
Hostheader**; pin a canonical domain and validate at the edge.
Target: a system you are authorised to test — the PortSwigger Web Security Academy Host header labs are purpose-built for this. Never a system you do not own. See [hacking-ethics-and-authorization](hacking-ethics-and-authorization).
Estimated time: ten to fifteen minutes.
When you are ready, send the Continue signal.