Hacking — The Blank Host Header trick
Concise tip: Try to find places in websites where the “host” HTTP header is reflected on the page. If you find this, try a blank host header in the request and the website may leak internal hostnames!
My report: https://hackerone.com/reports/548094
Full story: Host headers are a great thing to mess with when penetration testing on web applications. They serve so many different purposes across different sites from creating links in email POST requests to actually being reflected in places in the response. While many already know about poisoning links in emails when that POST request scenario plays out, there’s also an way to escalate host header injection when the host header is reflected in the response that relies on tricking the web server into leaking it’s own internal hostname/IP.
If a site is reflecting the host header in the response even when you it to something like example.com, it may be vulnerable to this. First, you need to change the HTTP protocol on the request from HTTP/1.1, the default, to HTTP/1.0. This is because empty host headers are invalid in the newer protocol. This is done in different ways depending on how you are replaying this HTTP request, but for example in Burp Repeater, you simply change “HTTP/1.1” in the top line of the request to “HTTP/1.0”. Next, you want to make the “host” HTTP header blank, so it looks like “Host:”. Now when you send the request, the response may show an IP address or a weird looking web address where the host header was previously reflected. 99% of the time this is an internal hostname or an internal IP address. These can be used in other exploits to perform attacks on internal infrastructure, so companies generally do not want these leaked!
This is common on Apache servers when the bottom line of an error page reads something like “Apache Server at example.com Port 443” because example.com is simply being reflected from the host header in the request. Thank you to Ping Identity for a great report process and for writing a nice summary that you can read on the Hackerone report page as well.
