http-host-header-attackslisted

# SKILL: HTTP Host Header Attacks — Injection & Routing Abuse > **AI LOAD INSTRUCTION**: Covers Host header injection for password reset poisoning, cache poisoning, SSRF via routing, and virtual host bypass. Includes bypass techniques for Host validation and framework-specific behaviors. Base models often miss the double-Host trick, absolute-URI override, and connection-state attacks. ## 0. RELATED ROUTING - [web-cache-deception](../web-cache-deception/SKILL.md) when Host injection is combined with cache behavior - [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md) when Host header routes requests to internal services - [open-redirect](../open-redirect/SKILL.md) when Host injection causes redirect to attacker domain - [waf-bypass-techniques](../waf-bypass-techniques/SKILL.md) when Host manipulation helps bypass WAF routing - [request-smuggling](../request-smuggling/SKILL.md) when smuggling enables Host header manipulation past front-end validation - [subdomain-takeover](../subdomain-takeover/SKILL.md) when Host routing exposes internal vhosts resolvable via subdomain --- ## 1. ATTACK SURFACE The Host header is used by web applications and infrastructure for: | Usage | Exploitation | |---|---| | URL generation (password reset links, email links) | Inject attacker domain → user clicks link to attacker | | Virtual host routing | Spoof Host → access internal/admin vhost | | Cache key component | Inject different Host → poison cache for all use