SkillsAdd

wgpsec/aboutsecurity

http-host-header-attacks

HTTP Host Header 攻击方法论。当目标存在密码重置、缓存机制、反向代理、虚拟主机、重定向功能时使用。覆盖密码重置投毒(Host注入窃取reset token)、Web缓存投毒(Host控制缓存键)、通过Host路由SSRF、虚拟主机枚举与跨站读取、绕过技术(X-Forwarded-Host/双Host/绝对URI/端口注入/换行符注入)。任何涉及密码重置、Host头处理、缓存、虚拟主机配置的测试都应使用此 skill

First seen Apr 22, 2026

Installation

$ npx skills add https://github.com/wgpsec/aboutsecurity
View on skills.sh ↗ GitHub repository ↗
Feature your product here Skill page unit · reach builders installing agent skills View pricing →

Summary

HTTP Host Header 攻击方法论。当目标存在密码重置、缓存机制、反向代理、虚拟主机、重定向功能时使用。覆盖密码重置投毒(Host注入窃取reset token)、Web缓存投毒(Host控制缓存键)、通过Host路由SSRF、虚拟主机枚举与跨站读取、绕过技术(X-Forwarded-Host/双Host/绝…

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

jwt-oauth-token-attacks Similar name
yaklang/hack-skills

>- JWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, ke…

19 installs
http-host-header-attacks Similar name
yaklang/hack-skills

>- HTTP Host header injection and routing abuse playbook. Use when the application trusts the H…

18 installs
http2-specific-attacks Similar name
yaklang/hack-skills

>- HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need t…

17 installs
saml-sso-assertion-attacks Similar name
yaklang/hack-skills

>- SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrappin…

18 installs
active-directory-kerberos-attacks Similar name
yaklang/hack-skills

>- Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-R…

17 installs
dns-rebinding-attacks Similar name
yaklang/hack-skills

>- DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for o…

17 installs

Also in this package

Other skills from wgpsec/aboutsecurity · top by installs.

npx skills add https://github.com/wgpsec/aboutsecurity
prompt-jailbreak 62 ctf-reverse 46 ad-domain-attack 45 nuclei-scan 45 efficiency-rules 45 report-generate 43 ctf-web-recon 43 ctf-crypto 43 ctf-pwn 41 passive-recon 41

Browse all from wgpsec/aboutsecurity

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Also listed on

Alternate registries and mirrors of this skill.

Repository health

Stars 1.7K
Default branch master
Open issues 0
Status Active

History

  1. First seen on skills.sh
  2. First recorded snapshot · 16 installs