loading
Loading content
loading
Vulnerabilities
Host header injection and CORS checks on URL lists.
overview
xforwardy probes where an app trusts the Host header. Crafted Host and forwarding headers surface injection that enables cache poisoning, password-reset poisoning, and attacker-controlled routing. The same pass checks CORS misconfiguration.
Interface is two inputs: -u for one target, -i for a URL file. Drop it on crawler or live-host prober output to cover a whole surface without per-endpoint hand testing.
Pass -u for one host or -i for a URL file from httpx or a crawler; the node writes FILE plus FOLDER. Route flagged hosts into triage beside other findings. Prefer nuclei when you need broad template coverage beyond Host and CORS.
use cases
Probe a URL with manipulated Host and forwarding headers to flag where the app reflects or trusts them, the precondition for cache and reset poisoning.
Feed a file of live URLs so a whole crawled or probed surface gets the Host-header check in one node instead of endpoint by endpoint.
Run the built-in CORS check alongside the Host-header test so overly permissive cross-origin policies surface in the same pass.
Emit results downstream so flagged misconfigurations land alongside other vulnerability findings for review and prioritization.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| target-url | STRING | -u | URL of target website. |
| target-urls | FILE | -i | Input file of the URLs. |
Showing key inputs. xforwardy exposes 2 inputs in total.
example
# scan a URL list for Host header injection and CORS issuesxforwardy -i urls.txt[+] https://www.example.com - Host header reflection suspected[+] https://app.example.com/login - possible Host header injection[+] https://api.example.com - CORS ACAO reflects Origin[-] https://static.example.com - no Host/CORS issue flagged[*] https://staging.example.com - interesting forwarding header behavior[*] 3 findings across 5 URLsguidance
Use xforwardy for Host header injection and CORS checks across URLs. Run nuclei alongside for broader template-based coverage.
Template scanner with Host-header and CORS templates among many others. Broader, less specialized than xforwardy.
Hidden parameter discovery. Complements xforwardy when an injection needs a parameter as well as a header.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
A file of URLs feeds xforwardy, which probes each for Host header injection and CORS misconfiguration and writes the flagged findings as an output.
Facts on this page come from the live Trickest tool library.