CyLab Security Academy 2026 : Walkthrough North-South
Looking at the Nginx Config
In this challenge i was given a copy of the target’s nginx.conf file, and looking inside, the routing logic was pretty obvious:
The server uses a GeoIP database to check where you are connecting from. If your country code is IS (Iceland), it sends you to http://south (where the flag is). If you are anywhere else, you get sent to http://north which just displays a webpage saying "No flag in this region!".
The vulnerability here is Broken Access Control (IP/Geographic Spoofing). The developer is relying entirely on a user’s location for security, assuming that someone can’t just fake being in Iceland.
Try 1: Spoofing HTTP Headers (Failed)
At first, I tried to trick Nginx by injecting a bunch of proxy headers with an Icelandic IP (46.22.100.1) using a massive curl command.
I still got the Welcome!! No flag in this region! page. It failed because Nginx wasn't configured to read these headers, it just looked at my real public IP and blocked me anyway.
Try 2: Checking Server Headers
i ran a quick curl check to see what web server was actually running and if there was a load balancer in the way.
The server returned Server: nginx/1.24.0 (Ubuntu). This confirmed I was hitting Nginx directly, meaning headers were 100% useless and I had to find a way to get a real Icelandic IP connection.
The Solution (Using Tor)
Since Nginx checks the actual IP making the connection, I decided to use Tor to route my Kali Linux network traffic through an exit node physically located in Iceland.
Get Khalid Abdullahi’s stories in your inbox
Join Medium for free to get updates from this writer.
Installed Tor on Kali:
sudo apt update && sudo apt install tor -y
Opened the Tor config file (/etc/tor/torrc) using nano and added two lines at the bottom to force Tor to use an Icelandic exit node (is is the ISO country code for Iceland)
Restarted the Tor service to apply the new configuration
sudo systemctl restart tor
Finally, I sent the curl request again, but this time I routed it through Tor's local SOCKS5 proxy port (9050)
curl — socks5-hostname 127.0.0.1:9050 http://cylabacademy.net
it worked because the request came from a real Tor server in Iceland, Nginx read the Icelandic IP, matched it to IS in its database, triggered the if statement, and finally dropped the academy{...} flag in the terminal.
Vulnerability Identification
This infrastructure suffers from a architectural vulnerability known as Bypass of IP-Based Access Control (categorized broadly under OWASP A01:2021-Broken Access Control and CWE-290: Authentication Bypass by Spoofing).
The developer made a fundamental security error by using network routing metadata for authorization. They trusted that geographic boundaries would protect the sensitive backend application (http://south), assuming users could not easily falsify their physical origin.
Furthermore, looking at the geoip2 block, Nginx did not define an alternative header source (such as source=$http_x_forwarded_for). This meant Nginx evaluated location strictly using the Layer 4 network socket IP ($remote_addr).
