An HTTP server can host several sites on one network endpoint. The request's authority selects the virtual server before the application handles it. Find the hidden virtual host and retrieve the flag. Run /challenge/server, then interact with it at http://challenge.localhost/.

Applications sometimes use request authority to build absolute links. If that authority is attacker-controlled, a secret reset link can be sent to the wrong host. Poison the admin's reset link, run /challenge/victim, and recover the flag. Run /challenge/server, then interact with it at http://challenge.localhost/.

A reverse proxy creates a new connection to its backend. The backend therefore sees the proxy, not the browser, as its immediate network peer. Exploit that trust boundary and recover the flag. Run /challenge/server, then interact with it at http://challenge.localhost/.

Proxies often forward a client address in X-Real-IP. That value is trustworthy only when the proxy replaces attacker input. Exploit the proxy's handling of this header and recover the flag. Run /challenge/server, then interact with it at http://challenge.localhost/.

X-Forwarded-For represents a chain of hops rather than one address. A proxy may append its observation to a value that is already present. Exploit a backend that trusts the wrong end of the chain. Run /challenge/server, then interact with it at http://challenge.localhost/.

Werkzeug's ProxyFix trusts a configured number of proxy hops from the right of an X-Forwarded-For chain. That count must match the deployed topology. Exploit the mismatch and recover the flag. Run /challenge/server, then interact with it at http://challenge.localhost/.

Client address is only one piece of proxy metadata. A backend may also trust forwarded authority when building absolute links. Poison the admin's reset link across the proxy boundary, run /challenge/victim, and recover the flag. Run /challenge/server, then interact with it at http://challenge.localhost/.