Skip to content

Commit

Permalink
Fix typo
Browse files Browse the repository at this point in the history
"$host" holds the described value, not "$http"
  • Loading branch information
eidenschink authored and buglloc committed May 11, 2017
1 parent 11ebf7d commit a21d887
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions docs/en/plugins/hostspoofing.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ Spoofing of this header, may leads to a variety of problems, from phishing to SS
Most of the time it's a result of using `$http_host` variable instead of `$host`.

And they are quite different:
* `$http` - host in this order of precedence: host name from the request line, or host name from the “Host” request header field, or the server name matching a request;
* `$host` - host in this order of precedence: host name from the request line, or host name from the “Host” request header field, or the server name matching a request;
* `$http_host` - "Host" request header.

Config sample:
Expand All @@ -29,4 +29,4 @@ Luckily, all is quite obvious:

## Additional info
* [Host of Troubles Vulnerabilities](https://hostoftroubles.com/)
* [Practical HTTP Host header attacks](http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html)
* [Practical HTTP Host header attacks](http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html)

0 comments on commit a21d887

Please sign in to comment.