webeasy

Физический доступ (Physical Access)

hackerlab

Task: Web service with admin panel restricted by IP. Solution: Bypass IP-based access control by spoofing X-Forwarded-For header to 127.0.0.1.

$ ls tags/ techniques/
waf_bypassphpx_forwarded_forip_spoofingaccess_controlheader_injectionlocalhost_bypass
HTTP Header IP SpoofingX-Forwarded-For WAF bypassLocalhost access restriction bypass
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]