📛Bypassing WAF

This means the access is denied for our host but maybe the localhost can access.

Intercept the request:

Now we can use X-Forwarded-For Header to spoof the localhost: