Walks

网络安全爱好者

浅谈X-Forwarded-For伪造

前言:

什么是X-Forwarded-For伪造?

就是服务器获取访问IP时未做严格限制,导致访问IP是可以伪造的。


目录:

0x01:漏洞成因

0x02:漏洞危害

0x03:如何修复


漏洞成因

    在这,我复制一段网上的php代码来说的更清楚一点。以下都是依据此代码。

<?php
function getIP() { 
	if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { 
		$realip = $_SERVER['HTTP_X_FORWARDED_FOR']; 
	} elseif (isset($_SERVER['HTTP_CLIENT_IP'])) { 
		$realip = $_SERVER['HTTP_CLIENT_IP']; 
	} else { 
		$realip = $_SERVER['REMOTE_ADDR']; 
		} 
		return $realip; 
	}

echo getIP();
?>

 

    上面这段代码获取访问IP的时候,首先判断$_SERVER['HTTP_X_FORWARDED_FOR']是否存在,如果存在,则把这个值赋给realip,如果不存在,则再判断$_SERVER['HTTP_CLIENT_IP']是否存在,如果存在,把该值赋给

    realip,最后如果上述两个都不存在,则把$_SERVER['REMOTE_ADDR']赋给realip。最后,返回realip。

    在这HTTP_X_FORWARDED_FOR是可以通过修改HTTP头来重置的。

    下面,我们看下下图,当没有设置$_SERVER['HTTP_X_FORWARDED_FOR']和$_SERVER['HTTP_CLIENT_IP']时,可以从输出得知realip为127.0.0.1

《浅谈X-Forwarded-For伪造》

    而当我们修改了X-Forwarded-For:localhost时,可以从输入得知,realip变成了,localhost,此时,访问ip也就得到了伪造。

《浅谈X-Forwarded-For伪造》

    漏洞危害

    虽然只是伪造个IP,但危害也并一定就是小,危害大小视具体情况而定,下面就简单列举几个可能产生的危害

    1:当某后台不希望别人访问时,可以通过伪造IP访问该后台。

    2:当某刷赞刷量的业务时,如果基于访问IP,而这个值又可以修改,那么是不是可以刷赞刷量

    3:当我们前台撞库的时候,如果服务器是通过X-Forwarded-For来判断访问IP的时候,我们是不是就可以多次撞库和爆破了呢。还有等等,不多叙述。

    如何修复

    一切用户的输入都是有害的,所以我们要获取用户访问的真实IP。也就是用REMOTE_ADDR来获取IP。这个IP获取的是真实或者代理IP。

    

点赞
  1. Needed to post you this little bit of word to say thanks over again considering the extraordinary suggestions you've featured here. It has been quite seriously generous with people like you to make publicly just what a few individuals could possibly have offered for sale as an electronic book to help make some profit for themselves, certainly considering that you might have tried it in the event you considered necessary. The principles in addition worked to be a good way to be sure that other individuals have similar passion just as mine to grasp more regarding this issue. I believe there are many more pleasant situations in the future for those who browse through your blog post.

  2. fila disruptor说道:

    I would like to show thanks to this writer for bailing me out of this situation. After surfing throughout the the web and obtaining suggestions which were not pleasant, I believed my life was done. Living without the presence of solutions to the difficulties you've solved all through the short post is a serious case, as well as the kind that might have adversely affected my entire career if I had not noticed your web blog. Your own personal talents and kindness in maneuvering every aspect was tremendous. I don't know what I would have done if I hadn't encountered such a step like this. I am able to now look forward to my future. Thanks a lot very much for your high quality and results-oriented help. I will not think twice to suggest your web blog to any person who should get counselling about this problem.

  3. I want to express thanks to you just for bailing me out of this particular setting. Right after exploring throughout the world wide web and meeting suggestions which were not beneficial, I assumed my life was well over. Existing devoid of the answers to the difficulties you've sorted out as a result of your good article is a crucial case, and ones which may have in a negative way affected my career if I hadn't encountered your web page. Your actual training and kindness in dealing with the whole thing was excellent. I don't know what I would have done if I had not come across such a stuff like this. I can also at this moment relish my future. Thanks a lot so much for this skilled and results-oriented guide. I won't think twice to refer the sites to any person who needs to have guidance about this subject.

  4. louboutin shoes说道:

    I must express thanks to this writer just for bailing me out of this circumstance. As a result of researching throughout the the net and seeing ideas that were not helpful, I believed my entire life was done. Living without the presence of solutions to the problems you have fixed all through your good guideline is a critical case, and those which could have adversely damaged my entire career if I had not noticed your site. Your main talents and kindness in maneuvering the whole lot was precious. I am not sure what I would have done if I had not come across such a step like this. I can at this moment look ahead to my future. Thank you so much for your reliable and sensible guide. I will not hesitate to endorse the sites to anybody who should receive care on this subject matter.

  5. I enjoy you because of all your valuable work on this web site. My mother takes pleasure in making time for investigations and it is obvious why. Many of us learn all relating to the dynamic way you make reliable tips and hints by means of the web blog and improve response from some other people on this concept so our own girl is without question discovering a lot of things. Have fun with the rest of the new year. You are always doing a tremendous job.

  6. nike roshe one说道:

    I must show some appreciation to this writer just for bailing me out of this particular condition. Just after surfing through the online world and meeting ways that were not pleasant, I thought my entire life was over. Living without the solutions to the problems you have solved by means of your main review is a serious case, as well as those that might have badly damaged my entire career if I hadn't noticed your web blog. Your own talents and kindness in touching the whole lot was invaluable. I'm not sure what I would've done if I hadn't discovered such a step like this. I am able to now look forward to my future. Thanks for your time very much for this impressive and results-oriented guide. I won't hesitate to endorse the sites to anyone who should receive support about this topic.

  7. kobe 9说道:

    I precisely needed to appreciate you once again. I am not sure the things that I would've achieved without the actual concepts contributed by you directly on this topic. It became a scary matter for me, but spending time with a new specialized fashion you resolved that took me to weep over contentment. Now i am grateful for the help and as well , believe you know what an amazing job you are always accomplishing teaching men and women using your websites. Probably you have never come across all of us.

  8. I am glad for writing to make you know of the really good encounter our princess obtained going through your webblog. She learned some issues, which include what it's like to have a marvelous giving mindset to have many others completely thoroughly grasp chosen multifaceted matters. You actually exceeded readers' expectations. Thanks for churning out the beneficial, dependable, revealing and as well as unique thoughts on that topic to Emily.

  9. air jordans说道:

    Needed to create you this bit of remark to be able to say thanks a lot the moment again for all the beautiful strategies you have shown on this site. It was so tremendously generous with you to grant easily exactly what a few people would've supplied for an e-book to help with making some bucks for themselves, most importantly considering the fact that you might well have tried it in the event you wanted. Those strategies as well worked to provide a good way to know that other individuals have the same keenness like my own to realize whole lot more when it comes to this matter. Certainly there are a lot more pleasant occasions up front for individuals who scan your blog.

  10. lebron shoes说道:

    I'm commenting to let you be aware of what a really good experience my wife's girl undergone going through yuor web blog. She mastered some things, most notably how it is like to possess a very effective helping mindset to make the others without difficulty know precisely a number of specialized things. You actually exceeded my expected results. Thank you for presenting these important, trusted, edifying and even cool tips on the topic to Gloria.

  11. harden shoes说道:

    I would like to show my affection for your kind-heartedness for those people who really want guidance on this important field. Your special commitment to getting the solution all around turned out to be exceptionally effective and have usually helped many people just like me to realize their goals. Your new interesting tutorial denotes a whole lot to me and a whole lot more to my office workers. Regards; from each one of us.

  12. I as well as my friends have been looking at the excellent tips from your site and then came up with an awful feeling I never thanked the web site owner for those tips. My young men are already consequently warmed to study all of them and now have in reality been enjoying those things. We appreciate you genuinely indeed considerate and also for settling on some exceptional things most people are really desirous to know about. My sincere apologies for not expressing gratitude to you sooner.

  13. yeezy shoes说道:

    I precisely wanted to say thanks once more. I am not sure what I would have implemented in the absence of those information discussed by you relating to this field. It truly was a very alarming setting for me personally, however , seeing a new specialized technique you solved that forced me to leap with gladness. Now i am happy for your assistance and thus have high hopes you comprehend what a powerful job you have been accomplishing instructing many people with the aid of your webpage. I am certain you've never encountered any of us.

  14. pandora jewelry说道:

    I enjoy you because of each of your labor on this blog. Ellie really likes setting aside time for investigations and it is obvious why. A number of us notice all about the compelling mode you offer very important tips and tricks via your blog and as well boost participation from people on that content while our simple princess has been becoming educated a great deal. Take advantage of the remaining portion of the year. You're performing a really good job.

  15. jordan retro说道:

    Thanks so much for providing individuals with such a brilliant chance to read critical reviews from this site. It is usually very cool and as well , packed with fun for me personally and my office friends to visit the blog the equivalent of thrice a week to study the latest guides you have got. And indeed, I'm also at all times happy for the brilliant inspiring ideas served by you. Some 3 areas in this article are particularly the simplest we have had.

  16. Thank you so much for providing individuals with an extremely marvellous chance to read articles and blog posts from this blog. It's usually very sweet plus stuffed with fun for me and my office acquaintances to search the blog at the very least thrice in one week to study the fresh guidance you will have. Of course, we are usually fascinated for the fantastic tactics you give. Some 3 ideas in this article are absolutely the simplest I have had.

  17. I would like to express my thanks to the writer just for bailing me out of this type of condition. Right after looking out through the world-wide-web and finding views which are not beneficial, I believed my entire life was gone. Being alive without the presence of strategies to the difficulties you have fixed through your entire website is a serious case, and the kind that might have adversely damaged my career if I had not come across your web blog. The understanding and kindness in playing with a lot of things was tremendous. I'm not sure what I would have done if I hadn't encountered such a subject like this. I am able to at this point look forward to my future. Thank you so much for the high quality and sensible help. I will not be reluctant to propose your site to anybody who wants and needs guidelines on this matter.

  18. longchamp bags说道:

    I precisely wished to thank you so much all over again. I do not know the things I would have undertaken without the entire secrets documented by you regarding such a subject. It seemed to be an absolute distressing scenario for me personally, however , taking note of the very professional mode you treated the issue made me to jump with joy. I am happy for the assistance and in addition wish you recognize what a great job you were undertaking training others thru a site. More than likely you've never met any of us.

  19. yeezy boost说道:

    I'm also writing to let you be aware of of the magnificent discovery our daughter obtained visiting your web site. She came to find many things, which included how it is like to possess an amazing giving nature to let the mediocre ones very easily comprehend some very confusing subject areas. You actually exceeded people's expected results. Thank you for displaying the essential, trusted, informative and even fun tips on your topic to Jane.

  20. nba jerseys说道:

    My spouse and i were quite happy when Albert could finish off his web research through the entire ideas he came across from your own site. It's not at all simplistic just to happen to be freely giving methods that many many others could have been making money from. And we see we have got the website owner to give thanks to because of that. The type of explanations you have made, the easy blog navigation, the relationships you will assist to engender - it's got all terrific, and it's facilitating our son and our family reason why the subject is interesting, which is certainly truly mandatory. Many thanks for everything!

  21. air jordan说道:

    My spouse and i were relieved when Jordan could finish up his analysis while using the precious recommendations he received using your blog. It is now and again perplexing to simply find yourself giving for free steps that many men and women may have been trying to sell. Therefore we grasp we have got the writer to be grateful to for that. The main illustrations you've made, the straightforward blog navigation, the relationships your site assist to promote - it's most great, and it's facilitating our son and us reckon that this theme is excellent, which is extremely important. Many thanks for all the pieces!

  22. hermes birkin说道:

    I simply had to thank you so much once more. I do not know the things that I would have tried without those tricks shared by you concerning such question. It had been the troublesome dilemma in my position, nevertheless witnessing the specialised tactic you dealt with it forced me to cry with contentment. I will be grateful for this guidance as well as wish you recognize what a powerful job your are undertaking educating the rest by way of a blog. I am sure you've never encountered any of us.

  23. adidas gazelle说道:

    I definitely wanted to compose a quick comment so as to express gratitude to you for some of the unique secrets you are placing at this site. My time intensive internet search has at the end been recognized with good suggestions to share with my friends. I 'd state that that we visitors are rather fortunate to be in a wonderful website with so many awesome individuals with useful hints. I feel very much blessed to have discovered your web pages and look forward to really more enjoyable moments reading here. Thank you again for a lot of things.

  24. nike cortez men说道:

    Thank you for each of your labor on this site. Gloria really loves setting aside time for internet research and it's really obvious why. My spouse and i learn all relating to the lively means you deliver very helpful guidance on the web site and increase contribution from others on the article plus our favorite princess is certainly understanding a lot of things. Enjoy the rest of the year. You are doing a powerful job.

  25. adidas nmd说道:

    Needed to put you this bit of remark just to say thanks a lot as before just for the pretty information you have featured above. This is really wonderfully generous with people like you to make unhampered precisely what a few individuals could possibly have made available as an electronic book to earn some bucks for their own end, mostly considering the fact that you might have done it in the event you considered necessary. These basics in addition served to be the easy way to be aware that some people have the identical interest much like my very own to grasp more and more related to this issue. I am sure there are a lot more fun periods in the future for individuals that examine your site.

  26. nike max说道:

    Thanks so much for giving everyone an extremely marvellous possiblity to read articles and blog posts from here. It is often so enjoyable and packed with a lot of fun for me and my office acquaintances to search your blog the equivalent of thrice in a week to study the latest issues you have got. Not to mention, I'm always fascinated with your striking techniques you serve. Certain 3 facts in this article are honestly the most suitable I've ever had.

  27. I wish to show some thanks to the writer just for rescuing me from such a problem. Right after scouting through the the web and getting solutions which were not productive, I figured my entire life was over. Living without the presence of approaches to the issues you have fixed by means of your good website is a crucial case, and the ones which could have negatively damaged my career if I had not encountered your web blog. The capability and kindness in touching every part was tremendous. I don't know what I would have done if I had not come across such a point like this. It's possible to now look ahead to my future. Thanks a lot so much for the reliable and sensible guide. I will not hesitate to refer your web page to anyone who desires recommendations on this matter.

  28. kd shoes说道:

    Thank you a lot for giving everyone an exceptionally brilliant opportunity to read in detail from this blog. It can be very useful and also full of fun for me personally and my office fellow workers to visit the blog a minimum of three times in one week to study the fresh guides you will have. And lastly, I am also always fulfilled with the fabulous solutions served by you. Certain 3 tips in this post are without a doubt the most efficient we've ever had.

  29. Thank you so much for providing individuals with such a brilliant possiblity to discover important secrets from this site. It is usually so superb plus stuffed with fun for me and my office peers to search your web site at a minimum thrice in 7 days to find out the latest things you have got. And definitely, we are certainly fascinated with your dazzling inspiring ideas you give. Selected 4 facts in this post are basically the very best we have ever had.

  30. moncler说道:

    I enjoy you because of your whole hard work on this blog. Kate really likes carrying out investigation and it's really simple to grasp why. Most of us learn all relating to the powerful way you convey both useful and interesting thoughts by means of the website and as well as increase contribution from some other people about this matter then our favorite daughter is without question being taught a lot of things. Have fun with the rest of the new year. You have been doing a good job.

  31. asics sneakers说道:

    Thanks a lot for giving everyone a very brilliant chance to read critical reviews from this website. It is always so terrific and as well , packed with a good time for me and my office fellow workers to visit your blog really three times in one week to read the latest stuff you will have. And lastly, I'm always amazed with all the attractive methods served by you. Certain two ideas in this posting are completely the most efficient we've had.

  32. kobe 9说道:

    Thank you so much for providing individuals with an extraordinarily memorable possiblity to check tips from this blog. It is often very ideal plus packed with amusement for me personally and my office peers to visit your web site minimum three times in one week to learn the fresh issues you have. Not to mention, we're certainly fascinated with all the unbelievable tricks you serve. Selected 4 facts in this posting are rather the finest we have ever had.

  33. air max说道:

    Thank you a lot for providing individuals with an extremely marvellous possiblity to read critical reviews from this website. It really is very terrific and stuffed with fun for me personally and my office peers to visit your site not less than three times in 7 days to see the latest tips you have got. And definitely, I am also certainly fascinated with the gorgeous tricks served by you. Some 3 areas in this posting are basically the simplest I've had.

  34. I precisely wanted to thank you very much all over again. I do not know what I could possibly have implemented in the absence of those pointers discussed by you directly on this topic. It had become a real difficult matter for me personally, nevertheless seeing a expert technique you resolved the issue made me to weep over delight. I will be thankful for this service and in addition trust you realize what an amazing job you are always getting into educating men and women all through your webblog. More than likely you have never encountered any of us.

  35. hermes belt说道:

    I wanted to draft you this tiny note so as to say thanks yet again for the pleasant things you've documented on this website. It has been certainly strangely open-handed of you to make freely all a number of people would have distributed for an e book in order to make some dough for themselves, especially seeing that you might well have tried it in the event you wanted. The suggestions also worked like the good way to realize that many people have the identical zeal the same as my own to grasp a whole lot more concerning this matter. I'm sure there are lots of more pleasurable occasions up front for people who go through your website.

  36. Thank you a lot for giving everyone such a splendid chance to read critical reviews from this site. It is often very pleasurable and also full of amusement for me personally and my office peers to search your blog more than 3 times weekly to see the latest things you have got. And definitely, I'm also at all times motivated for the stunning pointers you serve. Selected 2 points on this page are particularly the finest we have had.

  37. balenciaga shoes说道:

    I and my pals have been following the nice information from your web page and then instantly got an awful feeling I never thanked you for those secrets. These boys appeared to be for that reason warmed to learn all of them and already have in reality been enjoying them. Many thanks for turning out to be considerably kind and for making a choice on some fine information millions of individuals are really desirous to discover. My very own sincere apologies for not expressing gratitude to you sooner.

  38. My husband and i ended up being so contented Edward could conclude his basic research using the ideas he received through the web site. It's not at all simplistic just to always be giving out helpful hints that the rest may have been making money from. We consider we need you to give thanks to because of that. The entire explanations you've made, the straightforward blog menu, the relationships you give support to instill - it's everything fantastic, and it's assisting our son in addition to our family do think that content is satisfying, and that is especially mandatory. Many thanks for all the pieces!

  39. I precisely wanted to appreciate you again. I'm not certain the things I would've undertaken without the recommendations documented by you about that field. It was before the scary situation in my position, nevertheless finding out this well-written strategy you processed it made me to weep with delight. I am just thankful for this advice and expect you comprehend what a great job that you're providing teaching some other people via your blog. Most likely you have never met any of us.

发表评论

电子邮件地址不会被公开。 必填项已用*标注