Questions tagged [host-headers]

The Host header is an HTTP header needed when multiple sites share a single IP address. See also http-headers.

Filter by
Sorted by
Tagged with
0 votes
0 answers
213 views

htaccess to stop Host Header Injection

I have one application hosted on XAMPP, my application url is https://abc.example.com/pps/prd/, i have htaccess file at pps/prd/, with following code to stop Host header injection RewriteEngine On ...
utsav's user avatar
  • 117
0 votes
1 answer
1k views

Host Name binding not working with wildcard (all) IP Address on IIS10

I am trying to configure a site binding on IIS10. I want to be able to run multiple sites on the same ports and differentiate the sites by their host header. For some reason IIS does not seem to ...
Malachy's user avatar
  • 101
2 votes
1 answer
7k views

Invalid HTTP_HOST header. NGINX config not preventing localhost invalid headers from IP port scanners hitting django

I am getting an Invalid Host header error from my server and I am unsure how to address it. The errors request URL is https://127.0.0.1:8000 and the obvious suggestion is to add localhost to my (using ...
Atayls's user avatar
  • 21
0 votes
0 answers
2k views

Host Header Injection in test lab

Trying to see if a server (in test lab) is vulnerable to host header injection or not. In second scenario where I insert host header as "www.cow.com", still get 302 Found. Does this mean ...
Pamelaxyz's user avatar
0 votes
1 answer
555 views

Certificate SNI and IIS host header

Context: IIS website with hostname header configured and TLS certificate. When a client initiates a connection to the specified site, is this the right flow ? Client (browser) performs DNS lookup TCP ...
Emilly's user avatar
  • 3
7 votes
2 answers
6k views

Is the Host: header required over SSL?

Is the Host: header required over SSL even if the request is not HTTP/1.1? So, if a client connects over SSL, and sends the following request: GET / HTTP/1.0 Should the web server throw a bad request ...
ImBoredAllTheTime's user avatar
2 votes
1 answer
12k views

How to prevent "host header injection vulnerability" in Nginx proxy server [closed]

Please help me to prevent "host header injection vulnerability" in the given "Nginx configuration file" server { listen 80 default_server; listen [::]:80 default_server; ...
aks's user avatar
  • 57
0 votes
1 answer
5k views

UseCanonicalName On applied however host of request header still wasn't change

I had an issue with website redirection and I found that my rewritecond input= 'www.example.com' and my request header host = 'example.com'. So I try to apply UseCanonimalName On in vhost where my ...
Petri's user avatar
  • 49
9 votes
2 answers
51k views

Configure HAProxy to include host headers for different backends

I am exploring the use of HAProxy as a balancer in front of a set of web apis that run on IIS. node1.myapp.mycompany.com node2.myapp.mycomapny.com We are currently using Host Headers to correctly ...
Matt's user avatar
  • 3,251
2 votes
1 answer
21k views

Publish different sites using a single IP and pfSense - Squid

I'm fairly new to pfSense, so bear with me please. To summarize, I have: A network with split DNS enabled. A single IIS web server with a single IP, different sites running using different host ...
Noor Khaldi's user avatar
  • 3,879
0 votes
0 answers
2k views

debian nginx 1.10.3 prevent headers injection

I have a debian 8 VPS running with nginx 1.10.3. I host several Symfony 3.2 websites (using php7-fpm), and I face headers injection problems. I can't figure out if the problem is more from nginx or ...
Flo Schild's user avatar
-1 votes
2 answers
105 views

Determine which server in VM environment to forward request to based on host header(s) on one network adapter [closed]

As the question title states: I'm trying to figure out how to discern which web server to pass network traffic to based on the host header of said request. I'm working with one network adapter on the ...
Erutan409's user avatar
  • 109
1 vote
1 answer
846 views

Including Port number in HTTP HOST header causes Service Unavailable error

We have a WebService running on HTTPS. If I use SOAPUI and make request at: https://testservice.mydomain.com/WcfService.svc, it works fine. However the client reported they are getting 503 Service ...
Anurag Kalra's user avatar
1 vote
1 answer
269 views

Prevent AWS load balancer serving on IP address

I've configured a Amazon Webservices Load Balancer for my site. It's all good the domain name resolves to the IP address of the Load Balancer Endpoint, and on the internal LAN it communicates with my ...
bendecko's user avatar
  • 141
1 vote
3 answers
10k views

Setting up a domain name to use host headers

I have a server that I want to host multiple web sites on using host headers. I know how to set IIS up but I am unsure how to set up the domain name. I have a domain name (ex. mydomain.com) that I ...
Brian Kalski's user avatar
2 votes
2 answers
7k views

Host Header Attack with reverse proxies

So I was tasked with researching a problem that was identified by an Acunetix web security scan. Here are the details about the scan: Host_header_attack Automated Detection of Host Header Attacks I ...
Tom17's user avatar
  • 333
1 vote
1 answer
2k views

curl 7.21 does not correctly call a host with a host header on https

We found out that calling a host like following using curl 7.21 or 7.24 does produce an error in the apache config (we have multiple SSL Vhosts!). Whereas the same command runs smooth with curl 7.34 ...
martinseener's user avatar
1 vote
1 answer
3k views

Any way to block IP address host header spoofing?

I have already added the following the following to my nginx config to deal with spoofed domains: if ($host !~* ^(.*example.org|\d+\.\d+\.\d+\.\d+)$ ) { return 444; } Right now ...
Jordan Reiter's user avatar
1 vote
1 answer
90 views

Single IIS, 2 applications, 2 IP addresses, 2 Domains, 2 SSLs

I know there are many questions out there, but none seemed to address specifically what I am after. I have one instance of IIS, with two separate applications on it. Each application works on its ...
Paul Grimshaw's user avatar
1 vote
1 answer
1k views

IIS7 Multiple Websites Same Port

I am trying to set up an internal-only web server of our production websites for QA and development testing. There is no need or intention to access this dev site from outside of the corporate network....
K0D4's user avatar
  • 123
1 vote
1 answer
201 views

IIS worker process and host headers

I am building a multi tenancy site in ASP.net. It will has three host headers. My understanding is that when a request comes to www.siteA.com, ISS will spin up a worker process for the for the ...
tom's user avatar
  • 111
0 votes
2 answers
4k views

IIS Host Header Bindings not working correctly

I have a Windows 2008 server with two websites. The first site has bindings for example1.com and www.example1.com. The second site has bindings for example2.com and www.example2.com. Each of ...
Mike's user avatar
  • 11
0 votes
1 answer
493 views

Host Header configuration for IIS

I am having some problems setting up a host header for a site. I want to create a second website like this using host headers in IIS Site: masteradmin Host Header: none XXX.XXX.45.28 Site: ...
chopps's user avatar
  • 113
2 votes
1 answer
683 views

IIS7.5 host headers multiple sites on localhost

I have troubles with IIS7 host headers. I'd like to create a domain for managing mysql with phpmyadmin. I tried to configure with these settings without success. The browser displays the localhost ...
inf3rno's user avatar
  • 408
1 vote
1 answer
170 views

Host Headers / Site Binding

I am going to prefix this that I am a programmer trying to figure out IIS7. I want to host two sites on my server. I created a second site and gave its own path. I added the two domains I want to ...
Joe Tyman's user avatar
  • 137
3 votes
1 answer
366 views

Interesting IIS weird 404 for files that exist, but only for a specific host header

So, I have a site with 2 host headers: header1.example.com header2.example.com In this site, I have a virtual directory called Foo and it has various sub-directories 1, 2, 3 & 4 that have ...
Adam's user avatar
  • 205
4 votes
1 answer
363 views

IIS HTTPS Host Headers

In IIS I need to map www.example.com and example.com to use a specific SSL certificate. I have tried using appcmd and editing applicationHost.config but I don't see how to tie each host-header to a ...
Josh M.'s user avatar
  • 688
0 votes
1 answer
1k views

How to configure host-header resolution in Windows Server 2003 IIS

I had a Windows 2000 server running two web-sites: Web-site: Newland IP Address TCP Port Host Header Name ================ ======== ================ (all unassigned) 80 Web-site: ...
Ian Boyd's user avatar
  • 5,373
0 votes
1 answer
2k views

Why is this host header going to another site?

I have two websites: Prod and Train In my hosts file I have two entries: xxx.xx.xxx.xxx prod.site.com xxx.xx.xxx.xxx train.site.com I have two separate websites set up in IIS7, Prod and ...
Brandon's user avatar
  • 451
1 vote
2 answers
6k views

Host-header from requests are ignored?

I read the apache docs, but there is a lot of stuff, which is different in Debian [lenny, 5.0.6]. Apache ignores the host-header given by the browser: http://x or http://x:81 or http://x.mbg.local ...
mabra's user avatar
  • 151
0 votes
1 answer
789 views

CISCO ASA 5505 Base Licence - Ability to interpret http request headers (host headers)

Base licence configured CISCO ASA 5505 is not capable of routing based on interpretation of the inbound http request headers - affectively host header redirect - am I correct? If I am correct will an ...
Klaptrap's user avatar
  • 157
1 vote
2 answers
2k views

How can I remove the default host header for SSL requests in IIS6

I have multiple sites setup on IIS 6 with host headers. One of those sites has an SSL certificate installed. So now if any of the non-SSL-enabled sites is requested with HTTPS it loads the SSL-...
Mike L's user avatar
  • 719
1 vote
1 answer
2k views

Authentication of users via IE when using "host header value"

I'm trying to set multiple web sites up in an IIS 6. I've got a working virtual site residing under the default web site, but if I create a new web site in IIS and assign it a host header value, let ...
user avatar
1 vote
2 answers
481 views

IIS, single UC cert, multiple sites and host headers. How does it all work together?

Let me start off my saying, IIS is not a strong point of mine. I had asked THIS question here, because i was trying to use 2 different certs on different sites. Scratch all that now, there is a new ...
DanBig's user avatar
  • 11.5k
0 votes
1 answer
531 views

IIS6 windows authentication failure in secondary domain

Technical Setup We have a website set with no anonymous access on a webserver (webtest.work.local), and making use of two hostheader values (with appropriate DNS entries created): 1. mySite.uat....
Andrew Bickerton's user avatar
0 votes
1 answer
1k views

How do I create host headers for internal ip address in IIS 6.0?

In IIS 6.0 I need to create host headers to host multiple websites on our web servers. We are using network load balancing manager to have a clustered web farm of three servers. Given that we use ...
Achilles's user avatar
  • 107
0 votes
4 answers
603 views

Can I use host headers for an SSL site?

I want to apply a certificate to one of my sites on IIS. At the moment, I use a single IP address and use host-headers, to give them friendly names. Can I do this for my SSL site or do I have to use ...
serialhobbyist's user avatar
0 votes
1 answer
155 views

Can you install a single domain certificate in IIS 6 with mutlple ip host headers?

If I have the A record in the DNS pointed to a unique IP address on our server, but have mutiple IP addresses associated with the host headers, will this cause an issue?
user avatar
0 votes
2 answers
584 views

How to set the priority of host headers in IIS 6?

On my IIS 6 Server, I have two sites: Site 1: abc.example.com //Should respond only to header value abc.example.com Site 2: 198.51.100.1 //Should respond if no host header matches However it seems ...
usr's user avatar
  • 245