This challenge is easy once you understand the concept of hop by hop HTTP headers.

There is two types of HTTP header:

End-to-end headers, which must be transmitted to the ultimate recipient of a request or response. They are present in the request all the way through to the end of it.

Hop-by-hop headers, which are meaningful only for a single transport-level connection. They are only processed by the present proxy handling the request.

Back to our challenge, once we enter the website and go to the admin page, we get:


the website is filtering the ip addresses to only allow access to local users.
What we can do is use the X-Forwarded-For HTTP header (which store our ip address) as a Hop-By-Hop header so the backend app wont be able to process our IP.

We can do that by adding X-Forwarded-For to the Connection header wich makes sure our IP isnt being communicated by proxies over further connections.


You can read more about this here: [Link](https://nathandavison.com/blog/abusing-http-hop-by-hop-request-headers)

Original writeup (https://github.com/5h3r10ck/RITSEC_CTF/blob/master/Hop_By_Hop/README.md).