hunt-host-header

SKILLWorkflowcommunity
v0.0.0elementalsoulsMITUpdated 1mo agoSource →

Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and abso

Community-submitted skill. Not yet reviewed by the Forge team. Full prompt content may not be available.Request review →
4kRepo stars
1Clients
1Formats
1mo agoLast update
Skill
Authorelementalsouls
Version0.0.0
LicenseMIT
CategoryWorkflow
Formatsskill.md
PromptOpen (see Prompt tab)
Compatibility
Claude✓ Supported
Cursor—
Copilot—
ChatGPT—
Gemini—
About

Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Bui

Keywords
skillclaude

No dependency coverage

This entry publishes no npm package, so Forge has no dependency tree for it. That is a gap in coverage — not a statement that it has no dependencies.