title: How to exploit HTTP header XSS vulnerability?
body: <p>Let's say that a page is just printing the value of the HTTP 'referer' header with no escaping. So the page is vulnerable to an XSS attack, i.e. an attacker can craft a GET request with a referer header containing something like <code>&lt;script&gt;alert('xss');&lt;/script&gt;</code>.</p>
  
  <p>But how can you actually use this to attack a target? How can the attacker make the target issue that specific request with that specific header?</p>