Thank you. I didn't know about gixy and ran it on my home server which found a vulnerability ($uri in a 301 redirect)