skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

401-403-bypass-techniques

Tests 401 and 403 access controls using path, method, header, and protocol bypass techniques.

Updated Jun 5, 2026
Search Tags:#access control#penetration testing#web security#ctf#path manipulation#header injection#403 bypass
One-click install
npx skills add https://github.com/lNwNl/Praxis --skill 401-403-bypass-techniques-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: 401-403-bypass-techniques
Source: https://github.com/lNwNl/Praxis/tree/main/skills/401-403-bypass-techniques
Command: npx skills add https://github.com/lNwNl/Praxis --skill 401-403-bypass-techniques-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When a web application returns 401 Unauthorized or 403 Forbidden on admin panels, API endpoints, or restricted paths, testers need a systematic way to determine whether the access control can be circumvented due to proxy/backend normalization mismatches. ## Core Features & Use Cases - Path Manipulation Matrix: Covers trailing slashes, case changes, URL/double-URL encoding, Unicode overlong encoding, dot segments, null bytes, and path parameters for servers like Tomcat, IIS, Nginx, and Apache. - Method, Header, and Protocol Bypasses: Documents HTTP verb tampering, X-Original-URL/X-Rewrite-URL rewrites, X-Forwarded-For IP spoofing, and HTTP/1.0 downgrade tricks, plus combination attacks. - Decision Tree and Tooling: Provides a prioritized testing workflow and automated scanner guidance (byp4xx, 403bypasser, dirsearch, feroxbuster). - Use Case: During an authorized web penetration test or CTF, a /admin endpoint returns 403; the tester follows the decision tree and discovers /admin..;/ returns 200 on a Tomcat backend, confirming an access control flaw. ## Quick Start Ask the agent to test the forbidden endpoint on the target using the 401/403 bypass playbook, starting with path manipulation tricks and then header-based bypasses.

Frequently Asked Questions about 401-403-bypass-techniques

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I bypass a 403 Forbidden error on an admin page?▼

Start with path manipulation: try trailing slashes (/admin/), case changes (/Admin), dot segments (/./admin), and encoded characters (/%61dmin). If those fail, try method changes, X-Original-URL headers, and X-Forwarded-For IP spoofing in that order.

What headers can bypass IP-based access restrictions?▼

X-Forwarded-For, X-Real-IP, X-Originating-IP, True-Client-IP, and Cluster-Client-IP set to 127.0.0.1 or ::1 can bypass IP whitelists when the backend trusts proxy headers. IP encoding variants like octal (0177.0.0.1) or decimal (2130706433) also work against weak parsers.

What is the difference between X-Original-URL and X-Rewrite-URL bypass?▼

Both headers tell the backend the real URL while the proxy sees an allowed path like GET /. X-Original-URL is associated with IIS and some frameworks, while X-Rewrite-URL appears in other rewrite pipelines; testers should try both against the same target.

Which tools automate 403 bypass testing?▼

byp4xx and 403bypasser automate header, path, and method bypass attempts and report response codes. dirsearch and feroxbuster handle content discovery with encoding variants, and Burp Intruder supports custom payload lists for manual testing.

Why do path traversal tricks like /admin..;/ work on Tomcat?▼

Tomcat treats semicolons as path parameters and normalizes dot segments differently than front-end proxies. The proxy sees a non-matching path while Tomcat resolves it back to /admin, creating an access control mismatch.

When should I stop trying 403 bypasses and use a different attack?▼

If path, method, header, protocol, and combination techniques all fail, switch to alternative approaches: request smuggling to pass the ACL entirely, SSRF to reach the resource server-side, IDOR for direct data access, or authentication flaw testing.

Related Skills

Explore More Software Engineering Skills→
bingookbingook

authbypass-authentication-flaws

Identify and exploit authentication flaws in web applications.

Community
Advanced
uphiagouphiago
1.1k

hunt-mass-assignment

Detect mass assignment vulnerabilities in web APIs and ORM-backed systems.

Community
Intermediate
wgpsecwgpsec
1.7k

middleware-tactics

Exploit Tomcat, WebLogic, JBoss, IIS, Nginx, and Apache middleware via weak credentials, WAR deployment, and parsing flaws.

Official
Intermediate
dreadnodedreadnode
11

h2c-websocket-smuggling

Bypass reverse proxy ACLs and WAF rules via H2C and WebSocket smuggling.

Official
Intermediate