Only admins allowed to login.
``` ### Spoofable Client IP We could deduce that perhaps the server filters requests by the client IP. A common security misconfiguration in implementing such a filter is the use of the [X-Forwarded-For header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For). This header is used for identifying the originating IP address of a client connecting to a web server through an HTTP proxy or a load balancer. Note that HTTP request headers can be [easily spoofed](https://portswigger.net/kb/issues/00400110_spoofable-client-ip-address). Knowing that one of the internal IP addresses is 172.16.2.155, we may want to check the 172.16.2.0/24 subnet for valid client IPs. If we do a scan (e.g. using Burp Suite Intruder) for the 172.16.2.0/24 subnet with the `X-Forwarded-For` header, we would find that if we set: ```http X-Forwarded-For: 172.16.2.24 ``` then we would see the login page. ### Burp Suite Intruder Scan First, set the payload position as follows:  Then, configure the payload as a list of numbers from 1 to 255.  Run the attack. Sort the output by either the Status or Length columns. We will find that `X-Forwarded-For: 172.16.2.24` gives us a 200 OK response code, and shows us the login page.  ### SQL Injection Once we have access to the login page, notice the login form fields. ```markup ``` We need to submit an `email` and a `pass` parameter. We can exploit SQL injection to get the flag. ```http POST /login.php HTTP/1.1 Host: localhost:55043 X-Forwarded-For: 172.16.2.24 ... Content-Type: application/x-www-form-urlencoded Content-Length: 51 email=test&pass=test' UNION SELECT 'test', 'test';# ``` The flag is `STC{w0w_you'r3_r3lly_a_l33t_h4x0r_bc1d4611be52117c9a8bb99bf572d6a7}`. 