Spoofing your IP address using match and replace - Port Swigger
Summary: PortSwigger's tutorial shows how Burp Proxy's match and replace rules can automatically add or modify headers on every request made through Burp's browser, and demonstrates spoofing an IP address by injecting a custom header the server trusts. In the walkthrough lab, the server uses the X-Custom-IP-Authorization header to determine a visitor's IP, and adding it via a match and replace rule grants access to the /admin panel that is otherwise restricted to local users.
Why it matters: The lab server trusted a client-supplied header to decide who was local, so a single injected header turned a blocked admin panel into an open one - the same pattern applies to any application that reads X-Forwarded-For or a custom header to make an access decision.
Read the original at PortSwigger Research ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026