I Found Host Header Injection & Got a Quick $1,000 Bounty! (Full Guide)

During a recent bug bounty hunt, I discovered a Host Header Injection vulnerability that led to account takeover, password reset poisoning, and phishing attacks. Within hours of reporting, I received a $1,000 bounty! 💰🔥

In this guide, I’ll break down exactly how I found, exploited, and reported this bug to maximize impact. Let’s get started! 🚀

Many websites rely on the Host header to determine the domain name. If improperly validated, attackers can manipulate it to cause security issues. 🚨

I started by sending a simple request to a login page:

Response:

🚀 Key Finding: The server was handling Host headers dynamically, making it a prime target for Host Header Injection!

I modified my request to inject a fake Host:

If the server does not properly validate the Host header, it could be used to: ✅ Hijack password reset links by sending victims a poisoned email.
✅ Bypass authentication systems that rely on the Host header.
✅ Perform web cache poisoning to inject malicious responses.

To check if the vulnerability was exploitable, I initiated a password reset on my test account. I received the following email:

🔥 Impact: The reset link was poisoned with my attacker-controlled Host header, allowing me to hijack accounts! 🚀

Once I confirmed the impact, I submitted a detailed report outlining: ✅ How the Host header was vulnerable.
✅ How it could be exploited for phishing, cache poisoning, and account takeover.
✅ A proof-of-concept (PoC) with a working attack scenario.

Within 24 hours, the security team responded and awarded me a $1,000 bounty! 💰🔥

1️⃣ Always test Host header manipulation in password reset & login pages.
2️⃣ Try injecting external domains (attacker.com) to see if they reflect.
3️⃣ Check if email confirmations use unvalidated Host headers.
4️⃣ Look for cache poisoning and authentication bypasses.

🛡️ Subscribe for Cybersecurity Videos: youtube.com/@theindiannetwork
💌 Need Ethical Hacking Consultation? Contact: theindiannetwork@protonmail.com