Bypass IP Restrictions with Burp Suite.
Tags: security, cybersecurity, tutorial, testing
Published: 2023-04-21 14:55:14


![Automatically add headers to all Burp requests to bypass basic WAF rules.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cp775hqc5008tpkg040w.png)

Some web applications implement IP-based protection rules that restrict users from accessing particular pages of an application like an admin page if their IP addresses are not in the allowed list. These rules are used as an access control mechanism.

It relies on having a proxy between the client and the server for forwarding requests. The proxy forwards the client’s IP to the server; if it is allowed or whitelisted, the server will respond with the requested page; otherwise, it will block the request.

The proxy does that by adding an **X-Forwarded-For** header that contains the client’s IP address to the request before sending it to the application. Then, the application checks the **X-Forwarded-For** header to determine whether the IP address of the client is in the allowed list.

_📌 The **X-Forwarded** header accepts two directives a **client IP** and **proxy IP**. It is possible to include multiple proxy IPs to send the requests; the traffic will bounce through the IPs successively before reaching the server._

**

## 📎 Syntax: X-Forwarded-For: <client>,<proxy1>,<proxy2>,<proxy3>
**

The attackers can take advantage of this and test the restriction rules by spoofing a different IP that they know is allowed by the application, like **localhost address 127.0.0.1.** Tricking the application into thinking the requests come from a trusted source, even though the original requests are coming from a different blocked IP.


![How it usually works!](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iwuj2kvp1p7imyxy59ri.png)

Since it is a pain to modify requests manually in attempts to bypass these WAF restriction rules, Burp can help automatically insert the required headers into each request sent to the application.🌋

There are 2 methods to achieve our goal through Burp Suite, either through **the match and replace rules**, which actually what I use all the time before discovering the **Bypass WAF extension.**

I was unaware of the extension before working on the **Control machine** on HTB, and I came across it when researching for better ways to automate forwarding requests.

Even though I liked using the extension, I am going to include both methods for reference 😃 .

## **Let’s begin !!**

**Method #1: Match/Replace Rules**

1- Navigate to the **Proxy tab** and click on **Options**. Scroll down to the **Match and Replace** section and click **Add**.


![Just Burp's Suite Window...](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pgao66yu6uinmj0vrh6g.png)


2- Specify the details needed for the matched Rule. We start first with specifying the **Type** of Rule; in our case, it is a **Request Header** since we want Burp to insert the modified header into all client requests.

Next, in the Match field, leave it blank to match all requests.

In the **Replace** field, we will enter the **X-Forwarded-For **header with the IP address we want to send requests from.

**_📍 Adding a comment is optional but helpful if you are using multiple rules at the time._**

When done, click **Ok** to save the rule.


![Burp Suite](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fuhi663qyqucl6bnfczm.png)

3- Check the **Enabled** box to enable the new **Rule**.


![🎓](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r6qlnb79putaa1muc6m8.png)

Now, we have the Rule configured, let’s test it out. Turn **Foxy Proxy** On or add the proxy setting to the browser, and refresh the page.


![😛](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wuwnr35litew4ks80mm4.png)

If we intercept the request with **Proxy**, we see Burp added the **X-forwarded header in all the sent requests.**


![First one](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/29rodd7rhg8dmmorkax2.png)


![Second one](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z2bo4xbiwm29kzvv7u61.png)

**

## Method #2: Bypass WAF Extension
**

The extension can be installed and configured to send X-forwarded headers automatically each time you navigate to the application.

1- Go to the **Extender** tab and click on the Burp **BApp Store**. Scroll down to the right pane and click on the **Install **Button.


![Bypass WAF Extension](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5mrxd7plfg86oyo6xdaj.png)


![BApp Store](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kp6zf2mhrmkprot8lvcy.png)

When the extension is installed, it will be added in the Extensions tab, and a new tab will be added in Burp Suite Tabs.


![As we see, the Bypass WAF extension tab is added to Burp Tabs.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kpvkd1ef6s8534abml67.png)

**_💡 You can remove an extension by going to the Extensions Tab and click on Remove._**

2- Next, we need to add a session handling rule to make Burp perform the required actions when making the HTTP requests.

Go to **Project options** and click on **Sessions**, then click **Add**.


![🤓](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5h6sx7wicym3lwavmzcn.png)

Insert the name of the Rule in the **Rule Description** and the action needed in **Rule Actions**. In our case, we want to **Invoke Burp Extension** that will allow us to use the **Bypass WAF extension.**


![Click **Ok** and choose the Bypass WAF extension. Then click Ok.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mt6kmo7858oowcihvi6a.png)


![😎](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jhe9ndakdrvh0qro5dg3.png)

4- In the Scope tab, check the **Proxy** box to enable it.

For the URL scope, we can either choose to **Include all URLs** or **Use a Targeted scope “User suite scope [defined in Target tab].**


![🐾](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uig2kzvga59ouzkqu47m.png)

5- Next, we configure the extension, click on the **Bypass WAF**, add the IP address in the **Header** field and click on **Set Configuration** to enable the bypass configuration.


![☺️](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dqk0henw94uutklg2xom.png)

6- Refresh the page, and test the extension.


![🐣](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0blhk1n0dtm1wn744xyh.png)

Great!! The extension works. The downside is when intercepting the requests, I don’t see the **X-Forwarded-For** headers are added like with the **_Match & Replace rule._**


![📡](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ieepjiy1pjpeogb94y23.png)

With a bit of research, I found that I can install the **Flow** extension to monitor the requests I send to the proxy and see how the Bypass WAF injects the x-forwarded header.

7- Go back to the **BApp Store** and install **Flow**.


![🤔](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uxl8hj7q88ld5kuncjly.png)

In the extension tab, make sure the **Flow** extension is added under the **Bypass WAF** extension. **_(🔔 order matters when monitoring requests)._**


![🦄](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pi7ey98kx20vrfzzcnx2.png)

8- Now refresh the page and go to the **Flow** tab. We can see the headers **Bypass WAF** injects to the requests we send to the server.


![☺️](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mwilegjh0xwzrv2w2gt5.png)

That’s all for today, Thanks reading.

_Sincerely,
Dmitry Sorokin,_
**403 Gone
REChain, Inc
Katya AI, Systems
Katya, Inc
Katya Systems, LLC
REChain Network Solutions**