title: java Host Header attack
body: <p>I am working on "Host Header Injection" attack for one of my client. The issue is, using Burp Suite they are capturing the request and modifying the Host header as below. The application is Java Servlet and hosted on apache (web Server) + weblogic (App servers) 
  Original request</p>
  
  <pre><code>GET /myContext/testServlet?rq=home&amp;tenId=123456 HTTP/1.1
  Host: beta.testinglab.com
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  </code></pre>
  
  <p>Modified request</p>
  
  <pre><code>GET /myContext/testServlet?rq=home&amp;tenId=123456 HTTP/1.1
  Host: www.google.com
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  </code></pre>
  
  <p>At Server side, even after modifying the "Host Header", request is submitted to "beta.testinglab.com" and when on server i use <code>request.getRequestUrl()</code> it gives me "www.google.com".
  Is there anyway to find out what was the original host that was requested. The request is making to correct host be internal redirection the issue.</p>
  
  <p>I can't maintain the predefined list of Host entries since this application is customized by lot many tenants. </p>
  
  <p>Is there any other way to fix this attack by changing configuration on Servers?</p>