alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING X-Forward-For Header Set to localhost"; flow:established,to_server; http.header; content:"x-forwarded-for"; nocase; fast_pattern; pcre:"/^.*(?:127(?:(\x2e0){1,}?\x2e1|(\x2e[0-9]{1,3}){1,3})|0177.?0000.?0000.?0001|7f000001|2130706433|01111111.?00000000.?00000000.?00000001|\x3a\x3a1|169\x2e254\x2e169\x2e254|ec2\x3a\x3a254|localhost)/Ri"; reference:url,community.owasp.org/attacks/Server_Side_Request_Forgery; classtype:misc-activity; sid:2072593; rev:1; metadata:attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_29, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Significant, confidence High, signature_severity Unknown, updated_at 2026_10_29, mitre_tactic_id TA0005, mitre_tactic_name Defense_Evasion, mitre_technique_id T1599, mitre_technique_name Network_Boundary_Bridging; target:dest_ip;)