What payload does hinject send?

One high-signal payload: X-Forwarded-Host carrying a random canary domain. It looks for that exact string rather than firing a large payload list, which keeps false positives low.

Can a reflected canary mean cache poisoning?

It can be a precondition. Reflection shows the app trusts a forged host value; cache poisoning or reset-link abuse still need a separate manual exploit step.

How does hinject differ from nuclei?

nuclei runs thousands of templates, including header-injection checks. hinject is a single-purpose X-Forwarded-Host reflection screen on a urls-list.

How should I feed many hosts into hinject?

Pass a urls-list FILE, one URL per line. Wire httpx in front so hinject only spends requests on hosts that responded, then route findings to reporting.

Updated Jul 14, 2026

Misconfiguration

Flag URLs that reflect a forged Host header

Batch host header injection checks against a URL list.

Screen an attack surface for host-header trust Confirm cache-poisoning and reset-poisoning exposure Gate the check on live hosts

overview

What hinject does

hinject sends each URL a request with X-Forwarded-Host set to a unique canary hostname, then reads the response. When the canary reflects in the body, the app trusts an attacker-controlled host value.

Use it after you have live URLs and want a single-purpose header-injection screen rather than a broad templated scan. Reflection is the precondition for cache poisoning and password-reset link poisoning.

Trickest runs hinject as a managed Misconfiguration node on a urls-list FILE, writing FILE and FOLDER findings. Place httpx upstream so only responding hosts are tested; prefer nuclei when you need many template classes at once.

source github.com/dwisiswant0/hinject

use cases

Where hinject fits

Screen an attack surface for host-header trust

Pipe a file of live URLs through hinject to find every host that reflects an X-Forwarded-Host value, the sign it trusts an attacker-controlled host.

Confirm cache-poisoning and reset-poisoning exposure

Treat a reflected canary as evidence that a host is a candidate for web cache poisoning or password-reset link poisoning before you invest in manual exploitation.

Gate the check on live hosts

Run hinject after httpx so it only tests URLs that responded, which keeps the request count and the noise down.

Fold into continuous recon

Schedule hinject behind subdomain discovery and probing so newly exposed hosts get the header-injection check as they appear.

reference

hinject inputs and flags

1 inputs

Name	Type	Flag	Description
urls-list	FILE	·	List of URLs to check for host header injection, one per line; streamed to the tool on stdin.

Showing key inputs. hinject exposes 1 inputs in total.

example

Run hinject

hinject · command

# pipe a URL list into hinject and flag host header injectioncat urls.txt | hinject -v

sample output

[VULNERABLE] https://staging.example.com/[ NOT VULN ] https://www.example.com/[ NOT VULN ] https://api.example.com/[VULNERABLE] https://dev.example.com/[  FAILED  ] https://legacy.example.com/[ NOT VULN ] https://app.example.com/[ NOT VULN ] https://mail.example.com/[VULNERABLE] https://cache.example.com/

guidance

Choosing hinject

Use when you have live URLs and need a focused host header injection check. Prefer nuclei for broad templated coverage. Run httpx first so only responding targets are tested.

nuclei

Template-driven scanner with host header checks among thousands. Broader, less focused on this one class.

hosthunter

Maps hostnames behind IPs. Useful before hinject to build the URL list, not a vulnerability check.

httpx

Probes which hosts are live. Run it first so hinject only tests responding targets.

faq

hinject questions

It sends each URL a GET with X-Forwarded-Host set to a unique canary hostname, then reads the response body. If the canary reflects, hinject prints the URL as VULNERABLE.

Run hinject yourself

A URL list is probed by httpx, then hinject tests the live hosts for host header injection and writes the findings as a queryable output.

Open hinject in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.