PoC of Misty API Explorer reverse proxy auth via URL injection

nginx.conf

# Copyright (C) 2018 rerobots, Inc.
# by SCL <scott@rerobots.net>
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
#
# generated random SHA256 hash, acts as auth token:
# e.g., create one in Python
#
#     import hashlib
#     import os
#     print(hashlib.sha256(os.urandom(128)).hexdigest())
#
# an example output from which is
#
#     545ad0dc06640ff88c1fc7311d53c964185798f179d48072d2a39999cca175ab

worker_processes 4;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    sendfile on;

    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    upstream app_server {
        server 127.0.0.1:8000 fail_timeout=0;
    }

    server {
        listen 80 default_server;
        listen [::]:80 default_server;

        location /545ad0dc06640ff88c1fc7311d53c964185798f179d48072d2a39999cca175ab:80 {
            rewrite /545ad0dc06640ff88c1fc7311d53c964185798f179d48072d2a39999cca175ab:80(.*)$ $1 break;

            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Host $http_host;
            proxy_redirect off;
            proxy_buffering off;
            proxy_pass http://app_server;

            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
        }

        location / {
            return 404;
        }

    }
}