I was practicing on one of the open source penetration testing frameworks bWAPP. I came across this code,
$url = "http://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]; echo $url;
I was able to find out a vulnerability in it. By using proxy, I was able to modify the HOST parameter in request body, I was able to reflect the same in my page. But, when I enter JS code or HTML code, I get an error
BAD Request. So, my first question, Is this really a vulnerability ?
On moving to intermediate level, I discovered this piece of code, which was based on JS.
$url = "<script>document.write(document.URL)</script>"; echo $url;