Loading...
Loading...
Found 2 Skills
Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Built on public Host-header research (PortSwigger 'Practical web cache poisoning' + James Kettle, and the classic password-reset-poisoning class). Use on any forgot-password flow, CDN/reverse-proxy-fronted app, OAuth/OIDC endpoint, or absolute-URL-in-email feature.
Cross-vendor identity mechanics for detection engineering — OAuth2/OIDC token flows (authorization code, client credentials, device code, ROPC), SAML assertion structure and forgery conditions (Golden SAML), Primary Refresh Token (PRT) mechanics, refresh token binding and lifetime, federation trust chains (ADFS-to-Entra, Okta-to-Entra), MFA ceremony flows (push, FIDO2, TOTP, phone), conditional access evaluation order, and session token lifecycle. Use when authoring detections that need to understand authentication protocol mechanics regardless of the specific identity platform.