Using a proxy isn't necessary. I wrote a PowerShell module SocketHttpRequest which allows one to submit a custom HTTP request to a destination. It was created to test applications without having to modify DNS or the local hosts file.
netcat
is another option: How to make an HTTP GET request manually with netcat?
In terms of what they're trying to achieve:
1) IP Address
Many internet scanners just scan IP address ranges looking for vulnerable web servers. When a web server is found, they send it a request using the destination IP address as the host header value (e.g. Host: 1.1.1.1
). No additional steps are taken to determine what website is actually being hosted (e.g. reverse dns lookup).
2) Alternative Host Values
Occasionally a request for an unknown host header value will be submitted. This is to see if the web server will respond with the "default" website; which allows any host header value and should be avoided. This is of greatest concern for web applications and Content Management Systems (CMS) that may rely on the host header value for generating links and other tasks.
Example: Suppose your website is configured to allow any host header
value and all links are dynamically generated based on that value.
I register a domain bad.com
to your web server IP address.
Upon visiting bad.com
, your website is displayed with all the links
resolving to bad.com
.
3) Security Filtering
In some cases, modifying the Host:
value is an attempt to bypass or enumerate any security filtering in place. This could be a Web Application Firewall (WAF), load balancer, web server, or modules within the application itself.
Fix
The best fix for this is two-fold.
- Websites should only respond to requests for the host header values registered in DNS. "Default" websites should be avoided.
- Applications should use
Host
values from configuration files and not rely on the server providing this value. This defense in depth mitigates the risk of a misconfiguration.