# Cracking the lens: targeting HTTP's hidden attack-surface

Malformed Host headers and @-style URLs tricked reverse proxies (Yahoo ATS, New Relic, DoD, BT) into routing requests to attacker hosts, exposing internal admin panels and enabling SSRF.

- Payout: $33,000
- Severity: critical
- Program: Yahoo! / Verizon Media, BT, New Relic
- Credited: James Kettle
- Disclosed: 2017-07-27
- Write-up quality: 10/10
- Original: https://portswigger.net/research/cracking-the-lens-targeting-https-hidden-attack-surface
- Library page: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-cracking-the-lens-targeting-https-hidden-attack-surface
- Tags: domain:web impact:data-leak impact:internal-access kind:research platform:research sev:critical tech:nginx technique:chained technique:recon vuln:host-header vuln:misconfiguration vuln:ssrf vuln:xss

**Target:** Reverse proxies, load balancers, backend analytics systems
**Root cause:** Reverse proxies and URL-rewriting code trust the Host header or user-supplied URI without validating that the resulting destination stays within the intended backend, so an attacker-controlled host or @-userinfo segment redirects the request.
**Steps:**
1. Send `GET / HTTP/1.1` with `Host: uniqid.burpcollaborator.net` to a reverse proxy; observe DNS/HTTP pingback
2. For Yahoo ATS: `GET / HTTP/1.1` with `Host: <internal-ip>:8082` and `Content-Length: 34` body `GET proxy.config.alarm_email` to read config
3. Use `set <var> = "<value>"` in the body to change ATS config (enable SOCKS, cache push)
4. For New Relic: `GET @burp-collaborator.net/ HTTP/1.1` with `Host: newrelic.com`; URIBuilder rewrites to `http://public-backend@burp-collaborator.net/`
5. For path-normalization bypass: `Host: ../?x=.vcap.me` yields `GET /vcap.me/../?x=.vcap.me` normalized to `http://outage.vcap.me/?x=whatever`
6. For Incapsula: `Host: incapsula-client.net:80@burp-collaborator.net` causes backend to auth to collaborator with user `incapsula-client.net`
7. For host-override: `GET http://internal-website.mil/ HTTP/1.1` with `Host: xxxxxxx.mil`
**How found:** Started by injecting pingback payloads (Burp Collaborator) into all traffic to make invisible systems contact the researcher. Noticed pingbacks from unrelated companies (cloud.mail.ru) arriving from BT IPs in 50ms, which was too fast for the claimed path; TCP traceroute revealed ISP interception. Noticed a Yahoo vulnerability only triggered 30% of scans due to DNS round-robin across three frontends, prompting mass scanning with ZMap/ZGrab. Observed a military server fetching `/jquery.js` and `/abrams.jpg` after a Host-header pingback, hypothesizing a caching pre-fetcher.
**Exploitation:** Attacker sends malformed requests to public reverse proxies; the proxy resolves the attacker-supplied host or @-userinfo and forwards the request to an attacker-controlled or internal destination. On Yahoo ATS the newline-terminated Overseer protocol was reachable via a GET with a POST-style body, allowing config read/write. On New Relic the rewritten URI reached internal admin panels unauthenticated. On DoD, host-override reached internal library and file-transfer services.
**Escalation:** Chained reflected XSS with a caching reverse proxy that pre-fetches resource imports: injected `<img src="http://internal-server.mil/index.php/fake.jpg"/>` caused the proxy to fetch and cache internal content, converting blind SSRF into readable internal data. Also used Collaborator Everywhere + ZMap/ZGrab to scan tens of thousands of IPs and correlate pingbacks.
**Insight:** When a target uses DNS round-robin or multiple frontends, a single scan misses vulnerable nodes — enumerate every IP behind the hostname and direct payloads at each. Also: a caching reverse proxy that pre-fetches resource imports can turn blind SSRF into readable internal data via an injected absolute URL, even when the app rejects unknown Host headers.