Reverse Proxy and Web Server Misconfigurations
Host header injection, path confusion between two normalizers, trusted headers, nginx alias, Apache .htaccess, IIS handlers and server-side includes.
Seven notes on the layer between the request and the application, covering the headers it trusts, the paths it rewrites and the directives each server reads differently.
Host Header Injection
Host looks like routing metadata until the application uses it to build password reset links, cache keys or absolute URLs. Host and forwarded headers help applications reconstruct the original URL behind proxies. Trusting client-supplied values creates authority confusion. Password reset poisoning, cache poisoning and virtual host confusion are common impacts when the value is not validated. I test Host, X-Forwarded-Host and Forwarded using a lab account and an endpoint that generates an observable absolute URL. Many proxies overwrite Host or remove forwarded headers. Testing needs to identify which value actually reaches the code building the URL.
1
2
3
4
POST /forgot-password HTTP/1.1
Host: attacker.example
email=lab-user%40example.test
Path Confusion Between Proxy and Application
A proxy and an application can receive the same URL and see different paths after decoding, slash normalization and routing. Reverse proxies apply path rules before forwarding. Frameworks may decode again, remove semicolon parameters or normalize slashes. Authorization bypass appears when the proxy protects /admin while the backend later interprets a variant as the same route. I document raw path, forwarded path and framework-visible path using lab logs or an echo endpoint. Double decoding and normalization bugs depend on layer ordering. Fixing one proxy regex may leave an equivalent variant.
1
2
GET /public/..%2fadmin HTTP/1.1
Host: app.example.test
Reverse Proxy Misconfigurations
A reverse proxy is often the first authorization layer and the last layer that knows where the request truly came from. Proxies terminate TLS, add identity headers, route paths and filter methods. Backends begin trusting metadata inserted by the edge. If a client can send the same X-User, X-Role or X-Forwarded-* headers and the proxy does not strip them, the trust boundary disappears. I compare direct and proxied requests, test duplicate headers and determine whether the backend is reachable through an alternate network path. Safe configuration removes client-controlled trusted headers before adding authoritative values and restricts direct access to the origin.
1
2
3
X-User: attacker
X-Role: admin
X-Original-URL: /admin
Nginx Misconfigurations
One missing slash in Nginx can change which file or upstream receives a request. Nginx alias, root, try_files, location and proxy_pass all have different path semantics. Alias traversal, unexpected location matching, internal redirects and header forwarding are common misconfiguration classes. In white-box testing I read the config and reproduce matching with canary paths. In black-box work I compare status, redirects and normalization. Generic hardening helps little when the location rule itself is wrong. The fix needs to match how Nginx selects blocks and builds the final path.
1
nginx -T | sed -n '1,220p'
Apache Misconfigurations
Apache can apply different rules by virtual host, directory, location and .htaccess. That flexibility also creates difficult review corners. <Directory>, <Location>, Alias, mod_rewrite and AllowOverride directives combine in the final decision. Directory listing, exposed status pages, unsafe CGI and inconsistent authentication rules appear in legacy environments. I collect vhosts, modules and effective configuration when possible. In black-box work I compare equivalent paths, methods and encoded variants. Disabling .htaccess with AllowOverride None reduces distributed configuration when the application does not require it.
1
2
apachectl -S
apachectl -M
IIS
IIS becomes interesting when the web application, Windows identity and NTFS filesystem meet inside the same request pipeline. IIS uses sites, application pools, handlers, modules and hierarchical web.config files. The app pool identity defines local and network access. Windows Authentication, WebDAV, request filtering, virtual directories and handler mappings create specific attack surfaces. I identify app pools, authentication methods, enabled modules and physical paths before testing alternate extensions or methods. Executable upload depends on handler mapping and directory configuration. An .aspx file stored where scripts are disabled may remain inert.
1
2
%windir%\system32\inetsrv\appcmd list site
%windir%\system32\inetsrv\appcmd list apppool
Server-Side Includes Injection
SSI looks like old technology until you find .shtml inside an appliance, intranet or server carrying decades of compatibility. Server-Side Includes processes directives in files before the response, including echo, include and sometimes exec depending on server configuration. Injection appears when controlled input is stored in or included by a file processed as SSI. I confirm handler behavior using a harmless variable echo before attempting any system operation. Many servers disable exec by default. Real impact depends on allowed directives and the file context.
1
<!--#echo var="DATE_LOCAL" -->