Collected research
At Home Among Strangers
Reverse proxies append the real client IP to X-Forwarded-For, so a spoofed value is normally harmless. Placing a bare carriage return in the header makes some back ends stop parsing at the CR and trust the attacker's value instead, defeating IP allowlists that guard admin interfaces.
Record
- Researcher
- Bo0oM
- Published by
- Speaker Deck
- Date
- Format
- Slides
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Bo0oM, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .