403-bypass

403 Bypass

Overview

A 403 doesn't always mean truly inaccessible. Misconfigured reverse proxies, CDNs, WAFs, and backend servers enforce access controls at different layers - creating parser-level gaps. This skill covers every known bypass class, from basic header tricks to conference-grade research techniques (DEF CON 2024, Black Hat 2024/2025, Orange Tsai's parser logic work, PortSwigger cache research).

Goal: Confirm whether a 403 is a hard block or a bypass-able misconfiguration, then document evidence for reporting.

Phase 0: Smart Intake

source ~/.claude/skills/_shared/phase0.sh
source ~/.claude/skills/_shared/signals.sh

p0_init_vars "$1"
p0_state_gate "HARVEST" || exit 0
p0_read_relay recon
p0_read_memory
p0_read_hypotheses

TECH_STACK=$KNOWN_TECH  # alias for downstream references

echo "=== PHASE 0 403-BYPASS INTAKE: $TARGET ==="
echo "State: $STATE | WAF: $WAF"
echo "Tech stack: $TECH_STACK"
echo "Target endpoints for bypass: $(echo "$INTERESTING_ENDPOINTS" | wc -l)"
echo "Top hypothesis: $TOP_HYPO_LABEL [$TOP_HYPO_PROB%]"
echo "ATW flagged (avoid): ${ATW_FLAGGED:-none}"

Execution Manifest

Build targeted manifest: one item per bypass technique class per target endpoint. Priority is determined by WAF type detected.

# WAF-to-priority mapping:
# Cloudflare  -> c02 (header), c05 (double-encode), c12 (automated), c17b (origin IP direct hit)
# Akamai      -> c10 (smuggling OPTIONS+line-folding CVE-2025-32094), c11 (cache deception), c02
# AWS WAF     -> c17 (ALB direct), c02 (header), c04 (path manipulation)
# Nginx+Apache-> c07 (path confusion CVE-2025-0108), c08 (off-by-slash), c15 (mod_proxy CVE-2024-38473)
# IIS         -> c18 (tilde enum + ADS), c22b (Apache ? bypass if applicable)
# unknown     -> c02, c04, c09, c12 (automated sweep)

MANIFEST=$(cat << 'MANIFEST_EOF'
{
  "phase": "403-bypass",
  "generated_at": "YYYY-MM-DD HH:MM",
  "items": [
    {"id":"b01","tool":"baseline","target":"<403-endpoint>","reason":"fingerprint WAF/CDN/server before trying anything","priority":"MUST","status":"pending","skip_reason":null},
    {"id":"b02","tool":"header-bypass","target":"<403-endpoint>","reason":"X-Forwarded-For/X-Original-URL IP spoofing","priority":"MUST","status":"pending","skip_reason":null},
    {"id":"b03","tool":"path-manipulation","target":"<403-endpoint>","reason":"encoding/case/extension tricks bypass string-match ACL","priority":"MUST","status":"pending","skip_reason":null},
    {"id":"b04","tool":"hop-by-hop-strip","target":"<403-endpoint>","reason":"strip auth headers via Connection: header","priority":"SHOULD","status":"pending","skip_reason":null},
    {"id":"b05","tool":"double-url-encoding","target":"<403-endpoint>","reason":"WAF decodes once, backend decodes twice (DEF CON 2024)","priority":"SHOULD","status":"pending","skip_reason":null},
    {"id":"b06","tool":"method-fuzzing","target":"<403-endpoint>","reason":"ACL may only block GET, not PUT/POST/TRACE","priority":"SHOULD","status":"pending","skip_reason":null},
    {"id":"b07","tool":"nomore403","target":"<403-endpoint>","reason":"330+ automated bypass techniques","priority":"MUST","status":"pending","skip_reason":null},
    {"id":"b08","tool":"waf-specific-bypass","target":"<403-endpoint>","reason":"targeted technique for detected WAF type","priority":"MUST","status":"pending","skip_reason":"skip if WAF=unknown"},
    {"id":"b09","tool":"h2c-smuggling","target":"<403-endpoint>","reason":"h2c upgrade causes proxy to stop inspecting requests","priority":"IF_TIME","status":"pending","skip_reason":null},
    {"id":"b10","tool":"prototype-pollution","target":"<403-endpoint>","reason":"Node.js/Express auth bypass via __proto__","priority":"IF_TIME","status":"pending","skip_reason":"skip if no Node.js in tech stack"}
  ]
}
MANIFEST_EOF
)

jq --argjson m "$MANIFEST" '.scalpel.active_manifest = $m' $SESSION > /tmp/s.json && mv /tmp/s.json $SESSION