alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING X-Real-IP Header Set to localhost"; reference:url,community.owasp.org/attacks/Server_Side_Request_Forgery; classtype:misc-activity; sid:2072598; rev:1; metadata:attack_target Web_Server, tls_state TLSDecrypt, created_at 2026_10_29, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Unknown, updated_at 2026_10_29, mitre_tactic_id TA0005, mitre_tactic_name Defense_Evasion, mitre_technique_id T1599, mitre_technique_name Network_Boundary_Bridging;)