Listen to this Post
Introduction
In modern cloud environments, trust boundaries are often implemented through IP-based whitelisting — a practice that assumes traffic originating from the same datacenter, region, or cloud provider is inherently trustworthy. This assumption creates a dangerous attack surface: what if an attacker could simply masquerade their traffic as if it were coming from an allowed location? At DEF CON’s Bug Bounty Village, Michael from Assetnote unveiled Newtowner, an open-source tool that systematically abuses these trust boundaries by requesting a URL from six different global regions, revealing which hosts mistakenly allow access based solely on geographic origin. This article explores how Newtowner works, the broader ecosystem of Assetnote’s security tools, and how security professionals can leverage these techniques to identify and remediate critical access control misconfigurations.
Learning Objectives
- Understand how IP-based trust boundaries in cloud environments can be systematically bypassed using geographic request routing
- Master the installation, configuration, and execution of Newtowner across multiple cloud providers (GitHub Actions, AWS, Cloudflare, etc.)
- Learn to integrate Newtowner with complementary tools like Surf (SSRF candidate discovery) and nowafpls (WAF bypass) for comprehensive access control testing
- Develop practical skills in 403 bypass techniques, including header manipulation, path traversal, and HTTP method tampering
- Implement effective mitigation strategies to prevent geographic trust boundary exploitation in production environments
You Should Know
1. Newtowner: Abusing Geographic Trust Boundaries
The core insight behind Newtowner is elegantly simple: many organizations configure firewall rules and network access controls to permit traffic from specific IP ranges — often those belonging to their cloud provider’s datacenter or a trusted partner’s network. Newtowner exploits this by routing HTTP requests through different cloud providers and regions, effectively “spoofing” the geographic origin of the traffic to test whether a given URL is accessible from locations it shouldn’t be.
How It Works:
Newtowner sends HTTP/HTTPS requests to a target URL from multiple cloud provider execution environments. Currently supported providers include GitHub Actions, GitLab CI, Bitbucket Pipelines, AWS API Gateway, AWS EC2, and Cloudflare Workers. The tool compares response codes and content across these different origins, highlighting instances where a 403 Forbidden from your machine becomes a 200 OK from a different region — a clear indicator of a misconfigured trust boundary.
Step-by-Step Guide:
Step 1: Installation and Setup
Clone the repository and configure your credentials:
git clone https://github.com/assetnote/newtowner.git cd newtowner
Create a `configuration.json` file in the root directory with your provider credentials. Here’s a minimal example for GitHub Actions:
{
"github_pat": "YOUR_GITHUB_PAT",
"github_owner": "your-username",
"github_repo": "newtowner",
"github_default_branch": "main"
}
Step 2: Prepare Your Target List
Create a text file containing the URLs you want to test, one per line:
echo "https://internal-admin.example.com" > urls.txt echo "https://api-staging.corp.com" >> urls.txt
Step 3: Run the Tool
Execute Newtowner with your chosen provider:
./newtowner --provider github --urls urls.txt
For AWS API Gateway, you can specify a region:
./newtowner --provider aws --region us-west-2 --urls urls.txt
Step 4: Analyze Results
Newtowner outputs a comparison of response codes and content lengths from each region. A response that differs significantly — particularly a 200 where others show 403 — indicates a trust boundary vulnerability.
Step 5: CI/CD Integration
Newtowner can be integrated directly into CI/CD pipelines for continuous monitoring:
- GitHub Actions: Configure the tool to run on a schedule or pull request
- GitLab CI: Use the `gitlab` provider with your project ID
- Bitbucket Pipelines: Leverage the `bitbucket` provider with workspace and repo configuration
- Surf: Escalating SSRF Vulnerabilities Through External IP Discovery
While Newtowner tests access from different geographic locations, Surf addresses a complementary problem: identifying SSRF (Server-Side Request Forgery) candidates that traditional filters miss.
The Problem: Most SSRF filters only block internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.169.254). However, many organizations deploy internal web applications on public IP addresses that are not accessible from the internet due to firewall rules at the network level. These external IPs for internal services are rarely added to SSRF blacklists, making them prime targets for exploitation.
Step-by-Step Guide:
Step 1: Installation
go install github.com/assetnote/surf/cmd/surf@latest
Step 2: Basic Usage
Given a list of subdomains for a target:
surf -l bigcorp.txt
This performs HTTP probing on each host and filters results into externally facing and internally facing hosts.
Step 3: Advanced Options
Adjust concurrency and timeout for large-scale scans:
surf -l bigcorp.txt -t 10 -c 200
Step 4: DNS-Only Mode
If you only want to resolve hosts to internal IP addresses without HTTP probing:
surf -l bigcorp.txt -x
Step 5: SSRF Exploitation Chain
Once Surf identifies viable SSRF candidates, you can test them in contexts where SSRF vulnerabilities exist. For AWS environments, this often means attempting to access the Instance Metadata Service:
Test for IMDSv1 access via SSRF
curl "${SSRF_URL}http://169.254.169.254/latest/meta-data/"
3. nowafpls: Bypassing WAFs Through Junk Data Insertion
Web Application Firewalls (WAFs) have inherent limitations in how much request body data they can inspect. nowafpls exploits this by inserting junk data into HTTP requests, pushing the malicious payload beyond the WAF’s inspection window.
Step-by-Step Guide:
Step 1: Installation in Burp Suite
- Clone the repository: `git clone https://github.com/assetnote/nowafpls.git`
- In Burp Suite, go to the Extensions tab
3. Click Add and select Extension Type: Python
4. Select the `nowafpls.py` file
Step 2: Using the Plugin
1. Send any request to the Repeater tab
- Place your cursor where you want to insert junk data
3. Right-click → Extensions → nowafpls
4. Select a preset amount or choose Custom
5. Click OK
Step 3: Understanding WAF Limits
Different WAF providers have varying inspection limits:
| WAF Provider | Maximum Request Body Inspection |
|–|–|
| Cloudflare | 128 KB (ruleset), up to 500 MB (enterprise) |
| AWS WAF | 8 KB – 64 KB |
| Azure WAF | 128 KB |
| Google Cloud Armor | 8 KB (up to 128 KB) |
Step 4: Automated Bypass Workflow
Combine nowafpls with other tools in your bug bounty workflow:
1. Use Surf to identify SSRF candidates
2. Use Newtowner to test geographic access controls
- Use nowafpls to bypass WAF protections on discovered endpoints
4. Document and report verified bypasses
4. 403 Bypass Techniques: Beyond Geographic Origin
While Newtowner focuses on geographic trust boundaries, 403 Forbidden responses can be bypassed through numerous other techniques. Understanding these methods is essential for comprehensive access control testing.
Common 403 Bypass Techniques:
Header Injection:
The most common bypass involves injecting headers that trick the server into believing the request originates from a trusted source:
X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Forwarded: for=127.0.0.1
Path Traversal and Encoding:
Bypass path-based restrictions using traversal sequences and encoding tricks:
/admin/../admin /admin/%2e%2e/admin /admin/.;/admin /admin//
HTTP Method Tampering:
Some access controls only restrict GET requests, leaving other methods open:
OPTIONS /admin HEAD /admin POST /admin PUT /admin
Automated Bypass Tools:
Several tools automate these techniques for efficient testing:
- nomore403: Command-line tool scoring bypass attempts
- Bypass-403: Professional toolkit with raw socket support
- 4-ZERO-3: Framework with automated bypass techniques
Step-by-Step Testing with nomore403:
Install go install github.com/devploit/nomore403@latest Basic scan nomore403 -u https://target.tld/admin With proxy for Burp integration nomore403 -u https://target.tld/admin -x http://127.0.0.1:8080 -v JSON output for analysis nomore403 -u https://target.tld/admin --jsonl -o findings.jsonl
5. Cloud Metadata Service Protection and SSRF Defense
Understanding how cloud providers protect against SSRF-based credential theft is crucial for both attackers and defenders.
AWS IMDSv2 vs. IMDSv1:
- IMDSv1: Simple HTTP GET to `http://169.254.169.254/latest/meta-data/` — trivially exploitable via SSRF
- IMDSv2: Requires a PUT request with a `X-aws-ec2-metadata-token-ttl-seconds` header, followed by using the returned token in subsequent requests
Testing for IMDSv1 Vulnerability:
Check if IMDSv1 is accessible curl http://169.254.169.254/latest/meta-data/ If this returns data, the instance is vulnerable
DNS Rebinding Attacks:
A more sophisticated SSRF bypass involves DNS rebinding, where an attacker’s DNS server returns different IP addresses during validation versus the actual request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability can defeat IP-based SSRF filters.
Mitigation Strategies:
1. Upgrade to IMDSv2 across all EC2 instances
2. Implement network-level restrictions on metadata service access
- Use allowlists for outbound HTTP requests rather than blocklists
4. Validate and sanitize all user-supplied URLs
- Implement proper authentication at the application layer, not just network controls
6. Cloud Hardening: Preventing Geographic Trust Boundary Exploitation
Organizations can implement several defensive measures to prevent the types of bypasses that Newtowner exposes.
Principle of Least Privilege:
- Restrict access based on identity and authentication, not just IP address
- Implement zero-trust network architecture where every request is authenticated
- Use mutual TLS (mTLS) for service-to-service communication
Network Controls:
- Implement strict firewall rules at the network layer
- Use VPC security groups with minimal required ingress
- Regularly audit security group rules for overly permissive configurations
Monitoring and Detection:
- Monitor for requests from unexpected geographic locations
- Implement rate limiting to detect scanning behavior
- Use WAF with geographic restriction capabilities
- Log and alert on 403 to 200 status changes for the same endpoint
Continuous Testing:
- Integrate Newtowner into CI/CD pipelines for ongoing validation
- Perform regular penetration testing of access controls
- Use automated tools like Surf to identify SSRF candidates before attackers do
What Undercode Say:
- Geographic trust boundaries are fundamentally flawed. Relying on IP-based whitelisting in cloud environments creates a false sense of security. Attackers can rent IP addresses in any region for pennies, making geographic restrictions a trivial obstacle. Newtowner demonstrates this vulnerability at scale, exposing how many organizations inadvertently grant access to internal resources based solely on where the request appears to originate.
-
The Assetnote toolchain represents a paradigm shift in access control testing. By combining Newtowner (geographic bypass), Surf (SSRF candidate discovery), and nowafpls (WAF bypass), security professionals have a comprehensive toolkit for identifying and exploiting misconfigured trust boundaries. These tools are not just for bug bounty hunters — they should be standard components of every organization’s security testing arsenal.
-
Defense requires a multi-layered approach. No single control is sufficient to prevent access control bypasses. Organizations must implement authentication at the application layer, validate all client-supplied headers, upgrade to IMDSv2 in cloud environments, and continuously test their configurations using tools like Newtowner. The most dangerous vulnerabilities are often the simplest — a 403 that becomes a 200 from a different IP address is a clear signal that your trust model is broken.
-
The democratization of security tools is changing the threat landscape. Open-source tools like those from Assetnote lower the barrier to entry for both attackers and defenders. While this increases risk for poorly configured organizations, it also provides defenders with the same capabilities to test and harden their own environments. The key is to adopt a proactive security posture — test your own systems before attackers do.
-
Context is everything in access control. A 403 Forbidden response is not an absolute barrier; it’s a configuration that may or may not hold up under different conditions. The most effective security professionals understand that access control is about context — the source IP, the HTTP headers, the request method, the path, and dozens of other factors all contribute to whether a request is allowed. Tools like Newtowner help us systematically explore that context space to find the gaps.
Prediction:
-
+1 The adoption of tools like Newtowner will drive a fundamental shift in how organizations approach network security. As more security teams integrate geographic bypass testing into their CI/CD pipelines, we’ll see a significant reduction in IP-based trust boundary misconfigurations over the next 18-24 months.
-
+1 The Assetnote toolchain will inspire a new generation of open-source security tools focused on access control testing. The success of Newtowner, Surf, and nowafpls demonstrates the demand for practical, easy-to-use tools that address real-world vulnerabilities, leading to increased innovation in this space.
-
-1 Organizations that fail to adopt proactive testing will face increased breach risks. The democratization of these tools means attackers have the same capabilities as defenders, and organizations that rely solely on traditional perimeter defenses will be increasingly vulnerable to geographic trust boundary exploitation.
-
-1 Cloud providers will need to evolve their offerings to address these vulnerabilities. While IMDSv2 and other security features represent progress, the fundamental issue of IP-based trust remains. We can expect to see more sophisticated authentication mechanisms and zero-trust architectures become standard in cloud environments.
-
-1 The complexity of modern cloud environments will continue to outpace security teams’ ability to manually test configurations. Automated tools like Newtowner are not optional — they’re essential for maintaining security at scale. Organizations that don’t adopt automation will fall behind, creating exploitable gaps in their defenses.
▶️ Related Video (78% Match):
https://www.youtube.com/watch?v=01T5JJGW4_c
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: That 403 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
