HTTP Host Header Attacks

Cross-platform resources for HTTP Host Header Attacks: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

HTTP Host Header Attacks

This page aggregates cross-platform resources to practice HTTP Host Header Attacks: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/host-header

PortSwigger labs practicing HTTP Host Header Attacks (5)

Lab	Difficulty	Topic	Official
Host header authentication bypass	APPRENTICE	HTTP Host Header Attacks	Open
Host validation bypass via connection state attack	PRACTITIONER	HTTP Host Header Attacks	Open
Routing-based SSRF	PRACTITIONER	HTTP Host Header Attacks	Open
SSRF via flawed request parsing	PRACTITIONER	HTTP Host Header Attacks	Open
Web cache poisoning via ambiguous requests	PRACTITIONER	HTTP Host Header Attacks	Open

---

← Back to the full glossary

Last updated: 2026-05-08