Skip to content

Instantly share code, notes, and snippets.

@wh1t3p1g

wh1t3p1g/bypass waf by http headers

Created July 4, 2016 08:07
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save wh1t3p1g/c32a554602c4d84a47b1f2d87926deef to your computer and use it in GitHub Desktop.
Save wh1t3p1g/c32a554602c4d84a47b1f2d87926deef to your computer and use it in GitHub Desktop.
Download ZIP
Raw
bypass waf by http headers
- X-forwarded-for
- X-remote-IP
- X-originating-IP
- x-remote-addr
waf通常会有一个不拦截任意请求的白名单ip，上面的几个头可以用来伪造ip
如：
X-Forwarded-For: 127.0.0.1
X-Remote-Ip: 127.0.0.1
X-Originating-Ip: 127.0.0.1
X-Remote-Addr: 127.0.0.1
参考：http://www.securityaegis.com/bypassing-web-application-firewalls-using-http-headers/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment