# HTML Injection - Reflected (URL)

## Security level: low

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FttJ2QlMUY199jUsyMVRq%2F1.png?alt=media&#x26;token=2f0b886a-b0ed-4327-ae37-3d22dce89305" alt=""><figcaption></figcaption></figure>

The application prints our current URL on the page.

Let's turn on the intercept in Burpsuite and reload the page.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FJZwtoHLwjiJfVIvIgRfs%2F2.png?alt=media&#x26;token=68bcb58e-1cfa-418c-a6c3-dabb387bd43a" alt=""><figcaption></figcaption></figure>

We can change the `Host:` field to any value we want.

```
Host: getHacked
```

Let's turn off the intercept so that the request reaches to the server.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FHlrxRnXQRVoMkri7q9MI%2F3.png?alt=media&#x26;token=e78d9609-ddea-4386-85bc-d95515237cb2" alt=""><figcaption></figcaption></figure>

We have successfully performed HTML injection.
