Browsers send Host Header to inform about the URL client wants to visit. Attackers can temper Host Header to manipulate how the application works. Here is how this attack occurs:
Attacker mak...
Updated May 13, 2020
Version 2.0
Blog Post
For “Match URL” section, enter (.) into the “Pattern”
(.) will match only the first character of the input string.
(.*) will match the whole input string twice because of the grouping parenthesis
.* will match the whole input string in a single pass
Is the intent to match only the first character of an input URL? Just be looking at the rule, I would guess it would cause all requests to the webserver to be redirected.
Enter ^([a-zA-Z0-9-_]+.)*domain.com$ into “Pattern” field (change domain name with yours)
You may want to escape the "." as in ([a-zA-Z0-9-_]+\.) and domain\.com, to ensure that the regex engine interprets the dot as a literal rather than a wildcard for any single character. As the pattern is currently written, an input string containing sv123!domain_com or domain;com would match.
Also, it might make sense to limit repetition of the ([a-zA-Z0-9-_]+\.) pattern. Maybe use {0,2} instead of * right after it. That would allow a match of zero to two subdomain levels max, such as mydomain.com, or server1.mydomain.com, or server1.svgroup0.mydomain.com.