News for hackers. Stuff that matters.

A comment on Anatomy of an Attack: How I Hacked StackOverflow (2012).

Re:Anatomy of an Attack: How I Hacked StackOverflow (2012) by bhsiao on Monday July 27, 2015 @03:09AM (#9953808)
It sounds like this was the root of the problem:

> But IIS was misconfigured to rewrite Remote_Addr from X-Forwarded-For if it existed.

Does anyone know why that might've happened? Is this something IIS does by default, something it inadvertently encourages, etc.? And is there another example of a web server doing something like this?

[ Parent | on HN ]
Re:Anatomy of an Attack: How I Hacked StackOverflow (2012) by sparaker on Monday July 27, 2015 @06:38AM (#9954372)
I think if its running infront of a proxy this is the default behavior. I think this is configured in other web servers like nginx, etc.
[ Parent | on HN ]