[Academy] Broken Authentication - Weak Bruteforce Protection

,
#1

hi guys.
i have a question about /question2 in weak bruteforce protection.
i used x-forward-for in header using curl, burpsuite, wfuz and many more tools.
but i can’t find the flag.
pls help me
how can i get the flag?

#2

try local address

#3

127.0.0.1??

#4

yep , with x-forward-for

#5

it works :+1:
tnx