Victim App — Dashboard
This page echoes back exactly what IIS/ASP.NET on this box saw for the incoming request.
Load the same URL through each front door (direct binding, L7 proxy, L4 relay, ALB, CloudFront) and diff the output.
| Identity |
|---|
| Server MachineName | EC2AMAZ-2H5MSJD |
| Server time (UTC) | 2026-08-10T18:02:37.8176464Z |
| Request.Url (as ASP.NET sees it) | https://sni-customer2.ttx.anthonyaws.com/default.aspx |
| Host header | sni-customer2.ttx.anthonyaws.com |
| Request.IsSecureConnection | True |
| HTTP Method | GET |
| Forwarding headers (populated by proxies/LBs, not the origin app) |
|---|
| X-Forwarded-For | (none) |
| X-Forwarded-Proto | (none) |
| X-Forwarded-Host | (none) |
| X-Forwarded-Port | (none) |
| Via | (none) |
| Server variables (raw IIS view) |
|---|
| SERVER_NAME | sni-customer2.ttx.anthonyaws.com |
| SERVER_PORT | 443 |
| SERVER_PORT_SECURE | 1 |
| LOCAL_ADDR (what IIS thinks its own IP is) | 172.31.81.148 |
| REMOTE_ADDR (who IIS thinks is connecting) | 216.73.217.86 |
| HTTP_HOST | sni-customer2.ttx.anthonyaws.com |
Test pages