Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Vulnerabilities

Probe URLs for Host header injection and CORS

Host header injection and CORS checks on URL lists.

Agent
Detect Host header injection pointsSweep a discovered surface for the bugCatch CORS misconfiguration too

overview

What xforwardy does

xforwardy probes where an app trusts the Host header. Crafted Host and forwarding headers surface injection that enables cache poisoning, password-reset poisoning, and attacker-controlled routing. The same pass checks CORS misconfiguration.

Interface is two inputs: -u for one target, -i for a URL file. Drop it on crawler or live-host prober output to cover a whole surface without per-endpoint hand testing.

Pass -u for one host or -i for a URL file from httpx or a crawler; the node writes FILE plus FOLDER. Route flagged hosts into triage beside other findings. Prefer nuclei when you need broad template coverage beyond Host and CORS.

source github.com/roottusk/xforwardy

use cases

Where xforwardy fits

Detect Host header injection points

Probe a URL with manipulated Host and forwarding headers to flag where the app reflects or trusts them, the precondition for cache and reset poisoning.

Sweep a discovered surface for the bug

Feed a file of live URLs so a whole crawled or probed surface gets the Host-header check in one node instead of endpoint by endpoint.

Catch CORS misconfiguration too

Run the built-in CORS check alongside the Host-header test so overly permissive cross-origin policies surface in the same pass.

Route findings into triage

Emit results downstream so flagged misconfigurations land alongside other vulnerability findings for review and prioritization.

reference

xforwardy inputs and flags

2 inputs
NameTypeFlagDescription
target-urlSTRING-uURL of target website.
target-urlsFILE-iInput file of the URLs.

Showing key inputs. xforwardy exposes 2 inputs in total.

example

Run xforwardy

xforwardy · command
# scan a URL list for Host header injection and CORS issuesxforwardy -i urls.txt
sample output
[+] https://www.example.com - Host header reflection suspected[+] https://app.example.com/login - possible Host header injection[+] https://api.example.com - CORS ACAO reflects Origin[-] https://static.example.com - no Host/CORS issue flagged[*] https://staging.example.com - interesting forwarding header behavior[*] 3 findings across 5 URLs

guidance

Choosing xforwardy

Use xforwardy for Host header injection and CORS checks across URLs. Run nuclei alongside for broader template-based coverage.

nuclei

Template scanner with Host-header and CORS templates among many others. Broader, less specialized than xforwardy.

x8

Hidden parameter discovery. Complements xforwardy when an injection needs a parameter as well as a header.

faq

xforwardy questions

Host header injection, where the app trusts an attacker-set Host header, and CORS misconfiguration. Both are checked per URL in one pass.

related

More Vulnerabilities tools

  1. agentsleak

    Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.

  2. commix

    Automates OS command injection detection and exploitation.

  3. dalfox

    Parameter mining and XSS testing with headless verification.

  4. dnsreaper

    Subdomain takeover scanner with cloud-zone intake.

  5. find-gh-poc

    Locate public CVE proof-of-concept repositories on GitHub.

  6. golemhalt

    Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.

Run xforwardy yourself

A file of URLs feeds xforwardy, which probes each for Host header injection and CORS misconfiguration and writes the flagged findings as an output.

Run xforwardy in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.