hunt-host-header
覆盖多种高价值链路，适合漏洞狩猎与渗测
包含可直接用于攻击的利用方法，易被滥用
检测与利用 Host Header 注入导致的各种攻击链（ATO、缓存投毒等）
用于发现和利用 Host Header 注入引发的攻击：密码重置污染导致 ATO、缓存投毒、通过 Host 路由触发的 SSRF、OAuth 重定向污染和邮件绝对 URL 污染等。遇到忘记密码流程、反向代理/CDN 前置或 OAuth/OIDC 接口时就会用。基于公开研究方法，把看似无害的 Host 字段变成大范围缓存或账户接管的切入口。
▸ 展开 SKILL.md 英文原文
Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Built on public Host-header research (PortSwigger 'Practical web cache poisoning' + James Kettle, and the classic password-reset-poisoning class). Use on any forgot-password flow, CDN/reverse-proxy-fronted app, OAuth/OIDC endpoint, or absolute-URL-in-email feature.
帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-host-header/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-host-header/SKILL.md"# HUNT-HOST-HEADER — Host Header Injection ## Grounding / Provenance This skill is built from the public Host-header attack literature, not invented payloads. Cite the *technique source* in your report, never a fabricated ID: - **Password-reset poisoning class** — the canonical write-up is Skelet's/Detectify-era "Practical HTTP Host header attacks" (the Django `request.get_host()` → password-reset-link case). Many frameworks built the reset URL from the request Host with no `ALLOWED_HOSTS`-style allowlist. Cite the framework + the reflected-Host behaviour you actually observed. - **Web cache poisoning via unkeyed Host / X-Forwarded-Host** — PortSwigger Research, James Kettle, "Pra