Trying to see if a server (in test lab) is vulnerable to host header injection or not. In second scenario where I insert host header as "www.cow.com", still get 302 Found. Does this mean this is vulnerable to host injection ? If it were not, would I see 404 not found?
Scenario 1:
kali01:~$ curl -v http://10.10.10.10/login.html
* Trying 10.10.10.10:80...
* TCP_NODELAY set
* Connected to 10.10.10.10 (10.10.10.10) port 80 (#0)
> GET /login.html HTTP/1.1
> Host: 10.10.10.10
> User-Agent: curl/7.67.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 Found
< Location: https://10.10.10.10:443/login.html
< Connection: close
< Strict-Transport-Security: max-age=15552000, preload
< X-Frame-Options: DENY
< Content-Length: 0
- Scenario 2:
When host header www.cow.com is inserted, I still get 302 Found.
kali01:~$ curl -H "Host:www.cow.com" -v http://10.10.10.10/login.html
* Trying 10.10.10.10:80...
* TCP_NODELAY set
* Connected to 10.10.10.10 (10.10.10.10) port 80 (#0)
> GET /login.html HTTP/1.1
> Host:www.cow.com
> User-Agent: curl/7.67.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 Found
< Location: https://www.cow.com:443/login.html
< Connection: close
< Strict-Transport-Security: max-age=15552000, preload
< X-Frame-Options: DENY
< Content-Length: 0
<
* Closing connection 0
