Host Header Injection

Host Header Injection

->Description:
A Host header attack, also known as Host header injection, is a web attack where the attacker provides a false Host header to the web application. Find more information about other types of injection attacks

->Replication Steps:
1) Go to (Target URL)and capture the request.
2) Now in Burpsuite add X-Forwarded-Host: bing.com under the Host Header.
3) Forward.
4)You will notice that the site is now redirected to Bing.com
Hence this is vulnerable to Host Header Injection.
->Impact:
Whenever a user visits this URL, it will redirect them to anysite.com. It is used in phishing attacks.

->Mitigation:
If possible, the application should avoid incorporating user-controllable data into redirection targets. In many cases, this behavior can be avoided in two ways:

Remove the redirection function from the application, and replace links to it with direct links to the relevant target URLs.

Maintain a server-side list of all URLs that are permitted for redirection. Instead of passing the target URL as a parameter to the redirector, pass an index into this list.

->I have also provided the video PoC, kindly tell me if you need more information.
Thank You