web challenge
Shadow Host
Rivermark Foods is investigating its customer support portal after a legacy reverse proxy left a trusted original-host header path in front of a diagnostics handler. Step in as the responder and follow the evidence.
Incident briefing
Scenario
You have been brought in to help Rivermark Foods investigate its customer support portal after a legacy reverse proxy left a trusted original-host header path in front of a diagnostics handler. The environment is intentionally vulnerable and isolated for this exercise.
Objective
Identify the internal host context the proxy expects, reproduce it in the request metadata, and capture the flag.
Skills
What you will practice
- proxy headers
- host routing
- request crafting
Ready to practice?
Launch an isolated target
Sign in to Locinode to receive a disposable lab environment and Kali workstation for this mission. Public pages never expose flags or intended solutions.
Enter range