401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.

SKILL: 401/403 Bypass Techniques — Expert Attack Playbook AI LOAD INSTRUCTION : Comprehensive 401/403 forbidden bypass techniques. Covers path normalization tricks, HTTP method override, header based bypasses (X Original URL, X Forwarded For), protocol version tricks, and combination attacks. Base models typically know 2 3 header bypasses but miss the full matrix of path manipulation variants and verb+path combos. 0. RELATED ROUTING [authbypass authentication flaws](../authbypass authentication flaws/SKILL.md) — broader auth bypass (login flaws, session handling) [waf bypass techniques](../waf bypass techniques/SKILL.md) — when bypass is WAF specific rather than access control [http host header attacks](../http host header attacks/SKILL.md) — Host header manipulation for routing bypass [request smuggling](../request smuggling/SKILL.md) — smuggle past access controls entirely [http2 specific attacks](../http2 specific attacks/SKILL.md) — h2c smuggling to bypass proxy ACLs 1. PATH MANIPULATION BYPASSES The core idea: the reverse proxy/WAF checks one path format, but the backend normalizes differently. 1.1 Trailing Slash / Missing Slash 1.2 Case Sensitivity Works when: proxy rule is case sensitive but backend is case insensitive (common on Windows/IIS). 1.3 URL Encoding 1.4 Double URL Encoding 1.5 Unicode / UTF 8 Encoding 1.6 Dot Segment / Path Traversal 1.7 Null Byte 1.8 Path Parameter Injection 1.9 Trailing Special Characters 1.10 Backslash (Windows/IIS) 1.11 Combined Path Tricks 2. HTTP METHOD BYPASS 2.1 Direct Method Change 2.2 Method Override Headers When the proxy blocks by method, but the backend reads override headers: 2.3 Custom / Invalid Methods 3. HEADER BASED BYPASS 3.1 URL Rewrite Headers (Nginx/IIS) These headers tell the backend the "real" URL, bypassing proxy level path checks: The proxy sees GET / (allowed), but the backend routes to /admin . 3.2 IP Spoofing Headers (Whitelist Bypass) Headers to try (each with values 127.0.0.1 , 10.0.0.1 , 0.0.0.0 , ::1 ): IP encoding variants: 0177.0.0.1 (octal), 2130706433 (decimal), 0x7f000001 (hex), localhost 3.3 Other Header Tricks 4. PROTOCOL VERSION BYPASS 5. VERB TAMPERING + PATH COMBINATION Combine multiple techniques for higher success rate: 6. TECHNOLOGY SPECIFIC BYPASSES Server Key Tricks Apache /admin/ (trailing slash), /.admin (dot prefix), /admin%0d (CR) Nginx /Admin (case), /admin../ (normalization), X Original URL: /admin IIS/ASP.NET /admin;.css (path param+ext), /admin\ (backslash), /admin::$DATA (ADS), /admin%20 Tomcat/Java /admin;foo (path param), /admin..;/ (traversal), /;/admin (empty param) Spring /admin.anything (suffix matching, older), /admin/ (trailing slash) 7. AUTOMATED TOOLS Tool Purpose URL byp4xx Comprehensive 403 bypass scanner github.com/lobuhi/byp4xx 403bypasser Automated header/path/method bypass github.com/sting8k/403bypasser dirsearch Directory brute force with encoding variants github.com/maurosoria/dirsearch feroxbuster Recursive content discovery github.com/epi052/feroxbuster Burp Intruder Custom payload lists for manual testing portswigger.net byp4xx usage 8. DECISION TREE 9. QUICK REFERENCE — KEY PAYLOADS

401-403-bypass-techniques