I’ve been researching online about Host Header injection and noticed the company I work for is vulnerable to it (I think), when I add in say `Host: www.google.com` our site redirects to Google. But I just can’t get my head around the dangers of this attack, as it involves manually modifying the request how can this be used in an attack?
I’ve tried Googling it, and just see stuff like Password Reset Poisoning but still can’t get my head around how you would trick a user into editing their request to point to your site.