Lab 287 — InsightFlow — SSRF via Host Header Routing and IP Spoofing

hackadvisor

Task: Analytics platform with nginx reverse proxy, Express.js app, and internal admin API on separate port — SSRF via connection tester with header injection. Solution: Discovered internal admin API on port 3001 via SSRF port scan, then bypassed IP-based access control by injecting True-Client-IP: 127.0.0.1 header through the SSRF endpoint's headers parameter to retrieve secrets.