Here is some hints for the HTB web challenge ApacheBlaze (easy) Step into the ApacheBlaze universe..
Burp is your friend for this challenge!
Console log the X-Forward-Host header with app.logger.error(…) in order to see if your request is triggering any interesting output.
Remember if u succeed to smuggle something you may get a result!