Skip to content
Nuclei Templates

External Service Interaction

ID: external-service-interaction

Severity: info

Author: andreluna

Tags: miscellaneous,http,misc,oast

Description

Section titled “Description”

External Service interaction via Host Header Injection.

YAML Source

Section titled “YAML Source”
id: external-service-interaction


info:
  name: External Service Interaction
  author: andreluna
  severity: info
  description: External Service interaction via Host Header Injection.
  reference:
    - https://portswigger.net/kb/issues/00300210_external-service-interaction-http
    - https://success.qualys.com/support/s/article/000006843
    - https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/17-Testing_for_Host_Header_Injection
  classification:
    cwe-id: CWE-918,CWE-406
  metadata:
    max-request: 1
  tags: miscellaneous,http,misc,oast


http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{interactsh-url}}


    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
        condition: or
# digest: 4b0a004830460221008d0bda3bf6ae5621ed6e130831823bdab1decda15a8227668dbb6c5dbd9dbdcc022100aee9cc06cf68cdf1f32b80c4b1837553e16298a374042a95ad22624e716e101e:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/miscellaneous/external-service-interaction.yaml"

View on Github