Specifcs of trigger for "http request path host header mismatch"

[ReneeRussell]

Hello,

I wanted to get clarification on what criteria analysis.service gets populated with "http request path host header mismatch"

Specifically does is it: domain mismatch , tld mismatch or entirely different domains altogether.

I see this  from Hunting Guide:

http.lua

analysis.service

http request path host header mismatch

The request path specified a host other than the value of the HOST:header

Indicative of domain fronting, though may be legitimate when used by CDNs.

[WilliamMotley1 · Accepted solution]

It checks the entirety.  If the domain portion is the same but the host portion differs, the meta will still be registered.

So, something (simplistically) like each of the below will trigger it:

    GET http://foo.example.com/ HTTP/1.1

    HOST: bar.example.com

    GET http://foo.example.com/ HTTP/1.1

    HOST: www.example.net

    GET http://foo.example.com/ HTTP/1.1

    HOST: www.someother.com