# Proxed
### Challenge Description
### Challenge Attachments
{% file src="" %}
X-Forwarded-For: 31.33.33.7
browsing to the website
let's send the request to burp repeater
so the app is whitelisting allowed ip addresses, so we have to find the allowed IP
we have the source code so let's check it out `(it's in the attachment rar file)`
open this file
now that we have found the allowed ip address we have to find a way to change our ip address and bypass the 403 forbidden
searching in hacktricks for 403 bypass methods we find a couple http headers that are used for identifying the originating ip address
> Note that only `X-Forwarded-For` is the http header that works because in the source code there is a check to allow only this header to identify the originating ip address
changing the originating ip address to the allowed ip address 31.33.33.7 bypasses the check and we get the flag
### Flag
```
DUCTF{17_533m5_w3_f0rg07_70_pr0x}
```
