Detect web cache poisoning, password reset link poisoning, and server-side routing hijack via spoofed Host headers.
Injects X-Forwarded-Host, X-Host, and dual Host headers to check if server reflects untrusted domain in emails, asset URLs, or cache keys.
Canonical test payload dispatched during security surface audits.
Host: evil.com / X-Forwarded-Host: evil.comWatch the probe engine test this signature in an isolated sandbox.
Hardcoded Base URL in Emails
const resetLink = `https://${req.headers.host}/reset?token=${token}`;const resetLink = `${process.env.APP_CANONICAL_URL}/reset?token=${token}`;Never construct sensitive links using dynamic request headers. Always use hardcoded canonical domain environment variables.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for Host Header & Cache Poisoning Scanner.
Checks commonly evaluated alongside Host Header & Cache Poisoning Scanner during surface discovery.
Detect SQL injection vulnerabilities in your web application before attackers exploit database access.
Find XSS vulnerabilities that could let attackers inject malicious scripts and steal customer sessions.
Detect exposed API keys, private tokens, and cloud secrets in client-side bundles and public responses.
Audit your site across all 41 vectors automatically on every deploy.