Modlishka adds X-Forwarded-For header

[jbarlowbignell]

The Golang reverse-proxy implementation adds an X-Forwarded-For header by default with the IP address of the client/victim. This is a bit of an opsec giveaway.

It's possible to disable this header by setting the X-Forwarded-For header to nil (see discussion at golang/go#31095).

I've tested this by inserting the following at line 106 in core/proxy.go:

request := HTTPRequest{r}
request.Header["X-Forwarded-For"] = nil // New
request.PatchHeaders(p)
request.PatchQueryString()

Many thanks!