💰 I Found Host Header Injection & Got a Quick $1,000 Bounty! (Full Guide) 🚀

Images By — -TheIndianNetwork

🚀 How I Found a Host Header Injection Bug & Earned a $1,000 Bounty

During a recent bug bounty hunt, I discovered a Host Header Injection vulnerability that led to account takeover, password reset poisoning, and phishing attacks. Within hours of reporting, I received a $1,000 bounty! 💰🔥

In this guide, I’ll break down exactly how I found, exploited, and reported this bug to maximize impact. Let’s get started! 🚀

🕵️‍♂️ Step 1: Finding a Target with Host Header Dependency

Many websites rely on the Host header to determine the domain name. If improperly validated, attackers can manipulate it to cause security issues. 🚨

I started by sending a simple request to a login page:

curl -I https://target.com/login

Response:

HTTP/1.1 200 OK
Server: nginx
X-Powered-By: PHP

🚀 Key Finding: The server was handling Host headers dynamically, making it a prime target for Host Header Injection!

🔥 Step 2: Injecting a Malicious Host Header

I modified my request to inject a fake Host:

GET /reset-password HTTP/1.1
Host: attacker.com

If the server does not properly validate the Host header, it could be used to: ✅ Hijack password reset links by sending victims a poisoned email.
✅ Bypass authentication systems that rely on the Host header.
✅ Perform web cache poisoning to inject malicious responses.

⚠️ Step 3: Confirming Password Reset Hijacking

To check if the vulnerability was exploitable, I initiated a password reset on my test account. I received the following email:

To reset your password, click the link below:
https://attacker.com/reset-password?token=123456

🔥 Impact: The reset link was poisoned with my attacker-controlled Host header, allowing me to hijack accounts! 🚀

📩 Reporting & Quick $1,000 Bounty

Once I confirmed the impact, I submitted a detailed report outlining: ✅ How the Host header was vulnerable.
✅ How it could be exploited for phishing, cache poisoning, and account takeover.
✅ A proof-of-concept (PoC) with a working attack scenario.

Within 24 hours, the security team responded and awarded me a $1,000 bounty! 💰🔥

🏆 Lessons Learned

1️⃣ Always test Host header manipulation in password reset & login pages.
2️⃣ Try injecting external domains (attacker.com) to see if they reflect.
3️⃣ Check if email confirmations use unvalidated Host headers.
4️⃣ Look for cache poisoning and authentication bypasses.

🔥 Want More Hacking Tutorials?

🛡️ Subscribe for Cybersecurity Videos: youtube.com/@theindiannetwork
💌 Need Ethical Hacking Consultation? Contact: theindiannetwork@protonmail.com