webProeasy
Lab 120 — InfraPulse
hackadvisor
Task: DevOps monitoring platform with admin API restricted to internal network (127.0.0.0/8). Solution: Discovered hidden admin endpoints in JavaScript comments, bypassed IP-based authentication by spoofing X-Forwarded-For header to 127.0.0.1.
$ ls tags/ techniques/
javascript_source_analysisxff_header_spoofingip_based_auth_bypass
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 322 — NetPulse — IP Spoofing to RCE via Polling Agent API— hackadvisor
- [web][Pro]Lab 384 — DevPulse — RCE via AI Log Assistant Prompt Injection— hackadvisor
- [web][Pro]Lab 97 — UptimePulse — SSRF Chain to RCE via Cloud Metadata— hackadvisor
- [web][Pro]Lab 130 — LearnPulse — SSTI in Signature Template Engine— hackadvisor
- [web][Pro]InfraScope — Blind SQLi to RCE via User-Agent Audit Logging— hackadvisor