search

codingo / VHostScan

A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.
GNU General Public License v3.0
1.2k stars 231 forks source link

Simple waf bypass headers #21

Closed codingo closed 7 years ago

codingo commented 7 years ago

By adding origin headers to all requests we can bypass some WAF products, for example:

X-Originating-IP: 127.0.0.1 X-Forwarded-For: 127.0.0.1 X-Remote-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1