+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: NGINX - X-Forwarded-For/X-Real-Ip (/showthread.php?tid=6280569)
NGINX - X-Forwarded-For/X-Real-Ip - HardStoN - Sep 28, 2024
Hi!
Lets say i have a vulnerable PHP web application that uses the Data being send from these headers, in some instances of the PHP there is (presumably) NGINX that overrides these headers with proxy_set_header or something like that, do you know any way of bypassing it?
maybe 1Day that NGINX has?
thank you
RE: NGINX - X-Forwarded-For/X-Real-Ip - DashPHP - Sep 28, 2024
Couldn't you just send a request with your adjusted headers? Sorry I am little confused.
RE: NGINX - X-Forwarded-For/X-Real-Ip - HardStoN - Dec 21, 2024
(Sep 28, 2024 06:00 AM)DashPHP Wrote: Couldn't you just send a request with your adjusted headers? Sorry I am little confused.
Wdym by that?
Nginx can overwrite headers before it reaches to the webserver
RE: NGINX - X-Forwarded-For/X-Real-Ip - DramaKing - Dec 21, 2024
(Sep 28, 2024 05:52 AM)HardStoN Wrote: Hi!
Lets say i have a vulnerable PHP web application that uses the Data being send from these headers, in some instances of the PHP there is (presumably) NGINX that overrides these headers with proxy_set_header or something like that, do you know any way of bypassing it?
maybe 1Day that NGINX has?
thank you
So what you're asking is how to get the real public IP address behind a reverse proxy / load balancer, right?
RE: NGINX - X-Forwarded-For/X-Real-Ip - HardStoN - Jan 8, 2025
(Dec 21, 2024 02:09 PM)DramaKing Wrote: So what you're asking is how to get the real public IP address behind a reverse proxy / load balancer, right?
No, here, imagine this.
the server Source code be like that:
PHP Code
<?php
$_SERVER["REMOTE_ADDR"] = $_SERVER["HTTP_X_REAL_IP"];
Now, there are some instances of the same CMS where i can successfully manipulate my real IP address (and they are behind NGINX).
And some other sites (also behind NGINX) that doesnt let that happen, my real IP is showing.
My question is why do you think it happens? The sources is different or nginx fucks me up?
BTW if anyone wants to join this project hit me up, if i could solve this it would definitely income some money for us.