Host Header injection - Slides
Download as PPTX, PDF1 like1,996 views
Host header injection is a high severity web security vulnerability that allows attackers to spoof the domain name of a website by manipulating the HTTP "Host" header. This can enable password reset poisoning, web cache poisoning, cross-site scripting, and access to internal hosts. Mitigation techniques include validating the Host header matches the target domain, creating a dummy virtual host to catch invalid headers, whitelisting trusted domains, and disabling support for X-Forwarded-Host headers.
Related topics:1 of 7
Downloaded 21 times
More Related Content
What's hot (20)
Ad
Recently uploaded (20)
Ad
Host Header injection - Slides
- 1. HOST HEADER INJECTION Presenter : Amit Dubey
- 2. What are HTTP HEADER? • Request and Response • Carries Information • Browser Request • Server Response • HTTP Header : HOST
- 3. What is Host Header Injection ? ■ But what happens if we specify an invalid Host Header ? ■ Original Request – ■ Edited Request –
- 4. Impacts - SEVERITY : HIGH ■ Web Cache Poisoning ■ Password Reset Poisoning ■ Cross Site Scripting ■ Access to internal hosts
- 5. Bypasses- ■ Multiple Host Headers ■ X-Forwarded-Host
- 6. Mitigation - ■ Reject any request that doesn’t match target domain ■ Validating Host header to ensure that the request is originating from that target host or not. ■ Creating an dummy virtual host that catches all requests with unrecognized Host headers. ■ By creating a whitelist of trusted domains. ■ Disable support for X-Forwarded-Host
- 7. QUESTION ? ~~~~~~~~~Thank you ~~~~~~~~~