---
# System prepended metadata

title: Dolph echoCTF writeup

---

# Dolph echoCTF writeup


`export ip=10.0.160.250`
| Port     | Service / version |
| -------- | ----------------- |
| 80       | nginx 1.10.3      |

HTTP is allow on 80 port

Check on browser
![](https://i.imgur.com/EKTw32s.png)



Found first flag in source of page and hidden page in comments
/admin page^
![](https://i.imgur.com/38MJabB.png)

We can try to bypass this by setting some X headers
![](https://i.imgur.com/f83R6CG.png)
bingo for X-Forwarded-For Header

