I wanted a curl line that would grab the disclosed internal IP from a webserver.
It turns out that you need to specify an empty host header, and the content length of 0 for it to work.
If you dont specify the empty host header, it will just spit back the XML with whatever host header you specify. And you need a content length of 0 because the server expects a content length header :/
Below is the curl line to get the IP in the body of the message:
curl -v -k -H "Host:" -H "Host;" -H "Content-Length: 0" -X PROPFIND http://example.com:1234
