[HardStoN]

Hi!
Lets say i have a vulnerable PHP web application that uses the Data being send from these headers, in some instances of the PHP there is (presumably) NGINX that overrides these headers with proxy_set_header or something like that, do you know any way of bypassing it?

maybe 1Day that NGINX has?

thank you

[DashPHP]

Couldn't you just send a request with your adjusted headers? Sorry I am little confused.

[HardStoN]

Couldn't you just send a request with your adjusted headers? Sorry I am little confused.

Wdym by that?

Nginx can overwrite headers before it reaches to the webserver

[DramaKing]

Hi!
Lets say i have a vulnerable PHP web application that uses the Data being send from these headers, in some instances of the PHP there is (presumably) NGINX that overrides these headers with proxy_set_header or something like that, do you know any way of bypassing it?

maybe 1Day that NGINX has?

thank you

So what you're asking is how to get the real public IP address behind a reverse proxy / load balancer, right?

[HardStoN]

So what you're asking is how to get the real public IP address behind a reverse proxy / load balancer, right?

No, here, imagine this.
the server Source code be like that:

PHP Code


<?php 
$_SERVER["REMOTE_ADDR"] = $_SERVER["HTTP_X_REAL_IP"]; 


Now, there are some instances of the same CMS where i can successfully manipulate my real IP address (and they are behind NGINX).
And some other sites (also behind NGINX) that doesnt let that happen, my real IP is showing.

My question is why do you think it happens? The sources is different or nginx fucks me up?

BTW if anyone wants to join this project hit me up, if i could solve this it would definitely income some money for us.