host-header-injection

Host Header Injection Scanner

Automatic Web Vulnerability Scanner.

This script identifies Host Header Injection vulnerabilities in a list of URLs or a specific domain, outputting the vulnerable locations along with the specific headers causing the vulnerability

A burp extention to find host header injection vulnerabilities

HTTP header security scanner. Finds Host header injection, web cache poisoning, request smuggling and unkeyed-input gadgets, assesses HSTS/CSP/cookie posture, confirms every finding with a second probe, maps it to OWASP ASVS 5.0 and PCI DSS 4.0.1 — and reports what it could not assess instead of counting it as a pass.

Host Header Injection Scanner Tool.

Simple website host header injection vulnerability checker.

Real-world bug bounty methodology — IDOR scoring, Host Header Injection validity, Open Redirect triage, WAF fingerprinting, and reporting templates. Built from live program experience.

During a security assessment, I identified a Host Header Authentication Bypass vulnerability caused by improper validation of the HTTP Host header. The application trusted user-controlled Host header values during request processing, allowing manipulation of security-sensitive logic.

SSRF & Host-Header reconnaissance fuzzer — finds and confirms bypasses from one raw request