vulnerable_url="$1/api/index.php/authorize" ...