loading
Loading content
loading
Misconfiguration
Batch host header injection checks against a URL list.
overview
hinject sends each URL a request with X-Forwarded-Host set to a unique canary hostname, then reads the response. When the canary reflects in the body, the app trusts an attacker-controlled host value.
Use it after you have live URLs and want a single-purpose header-injection screen rather than a broad templated scan. Reflection is the precondition for cache poisoning and password-reset link poisoning.
Trickest runs hinject as a managed Misconfiguration node on a urls-list FILE, writing FILE and FOLDER findings. Place httpx upstream so only responding hosts are tested; prefer nuclei when you need many template classes at once.
use cases
Pipe a file of live URLs through hinject to find every host that reflects an X-Forwarded-Host value, the sign it trusts an attacker-controlled host.
Treat a reflected canary as evidence that a host is a candidate for web cache poisoning or password-reset link poisoning before you invest in manual exploitation.
Run hinject after httpx so it only tests URLs that responded, which keeps the request count and the noise down.
Schedule hinject behind subdomain discovery and probing so newly exposed hosts get the header-injection check as they appear.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| urls-list | FILE | · | List of URLs to check for host header injection, one per line; streamed to the tool on stdin. |
Showing key inputs. hinject exposes 1 inputs in total.
example
# pipe a URL list into hinject and flag host header injectioncat urls.txt | hinject -v[VULNERABLE] https://staging.example.com/[ NOT VULN ] https://www.example.com/[ NOT VULN ] https://api.example.com/[VULNERABLE] https://dev.example.com/[ FAILED ] https://legacy.example.com/[ NOT VULN ] https://app.example.com/[ NOT VULN ] https://mail.example.com/[VULNERABLE] https://cache.example.com/guidance
Use when you have live URLs and need a focused host header injection check. Prefer nuclei for broad templated coverage. Run httpx first so only responding targets are tested.
Template-driven scanner with host header checks among thousands. Broader, less focused on this one class.
Maps hostnames behind IPs. Useful before hinject to build the URL list, not a vulnerability check.
Probes which hosts are live. Run it first so hinject only tests responding targets.
faq
A URL list is probed by httpx, then hinject tests the live hosts for host header injection and writes the findings as a queryable output.
Facts on this page come from the live Trickest tool library.