mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-26 06:30:37 +00:00
157 lines
9 KiB
Markdown
157 lines
9 KiB
Markdown
# 403 & 401 Bypasses
|
||
|
||
<details>
|
||
|
||
<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||
|
||
Other ways to support HackTricks:
|
||
|
||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|
||
|
||
<figure><img src="../../.gitbook/assets/image (1) (1) (2) (4).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
[**DragonJAR Security Conference es un evento internacional de ciberseguridad**](https://www.dragonjarcon.org/) con más de una década que se celebrará el 7 y 8 de septiembre de 2023 en Bogotá, Colombia. Es un evento de gran contenido técnico donde se presentan las últimas investigaciones en español que atrae a hackers e investigadores de todo el mundo.\
|
||
¡Regístrate ahora en el siguiente enlace y no te pierdas esta gran conferencia!:
|
||
|
||
{% embed url="https://www.dragonjarcon.org/" %}
|
||
|
||
## HTTP Verbs/Methods Fuzzing
|
||
|
||
Try using **different verbs** to access the file: `GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH, INVENTED, HACK`
|
||
|
||
* Check the response headers, maybe some information can be given. For example, a **200 response** to **HEAD** with `Content-Length: 55` means that the **HEAD verb can access the info**. But you still need to find a way to exfiltrate that info.
|
||
* Using a HTTP header like `X-HTTP-Method-Override: PUT` can overwrite the verb used.
|
||
* Use **`TRACE`** verb and if you are very lucky maybe in the response you can see also the **headers added by intermediate proxies** that might be useful.
|
||
|
||
## HTTP Headers Fuzzing
|
||
|
||
* **Change Host header** to some arbitrary value ([that worked here](https://medium.com/@sechunter/exploiting-admin-panel-like-a-boss-fc2dd2499d31))
|
||
* Try to [**use other User Agents**](https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/User-Agents/UserAgents.fuzz.txt) to access the resource.
|
||
* **Fuzz HTTP Headers**: Try using HTTP Proxy **Headers**, HTTP Authentication Basic and NTLM brute-force (with a few combinations only) and other techniques. To do all of this I have created the tool [**fuzzhttpbypass**](https://github.com/carlospolop/fuzzhttpbypass).
|
||
|
||
* `X-Originating-IP: 127.0.0.1`
|
||
* `X-Forwarded-For: 127.0.0.1`
|
||
* `X-Forwarded: 127.0.0.1`
|
||
* `Forwarded-For: 127.0.0.1`
|
||
* `X-Remote-IP: 127.0.0.1`
|
||
* `X-Remote-Addr: 127.0.0.1`
|
||
* `X-ProxyUser-Ip: 127.0.0.1`
|
||
* `X-Original-URL: 127.0.0.1`
|
||
* `Client-IP: 127.0.0.1`
|
||
* `True-Client-IP: 127.0.0.1`
|
||
* `Cluster-Client-IP: 127.0.0.1`
|
||
* `X-ProxyUser-Ip: 127.0.0.1`
|
||
* `Host: localhost`
|
||
|
||
If the **path is protected** you can try to bypass the path protection using these other headers:
|
||
|
||
* `X-Original-URL: /admin/console`
|
||
* `X-Rewrite-URL: /admin/console`
|
||
* If the page is **behind a proxy**, maybe it's the proxy the one preventing you you to access the private information. Try abusing [**HTTP Request Smuggling**](../../pentesting-web/http-request-smuggling/) **or** [**hop-by-hop headers**](../../pentesting-web/abusing-hop-by-hop-headers.md)**.**
|
||
* Fuzz [**special HTTP headers**](special-http-headers.md) looking for different response.
|
||
* **Fuzz special HTTP headers** while fuzzing **HTTP Methods**.
|
||
* **Remove the Host header** and maybe you will be able to bypass the protection.
|
||
|
||
## Path **Fuzzing**
|
||
|
||
If _/path_ is blocked:
|
||
|
||
* Try using _**/**_**%2e/path \_(if the access is blocked by a proxy, this could bypass the protection). Try also**\_\*\* /%252e\*\*/path (double URL encode)
|
||
* Try **Unicode bypass**: _/**%ef%bc%8f**path_ (The URL encoded chars are like "/") so when encoded back it will be _//path_ and maybe you will have already bypassed the _/path_ name check
|
||
* **Other path bypasses**:
|
||
* site.com/secret –> HTTP 403 Forbidden
|
||
* site.com/SECRET –> HTTP 200 OK
|
||
* site.com/secret/ –> HTTP 200 OK
|
||
* site.com/secret/. –> HTTP 200 OK
|
||
* site.com//secret// –> HTTP 200 OK
|
||
* site.com/./secret/.. –> HTTP 200 OK
|
||
* site.com/;/secret –> HTTP 200 OK
|
||
* site.com/.;/secret –> HTTP 200 OK
|
||
* site.com//;//secret –> HTTP 200 OK
|
||
* site.com/secret.json –> HTTP 200 OK (ruby)
|
||
* Use all [**this list**](https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/Unicode.txt) in the following situations:
|
||
* /FUZZsecret
|
||
* /FUZZ/secret
|
||
* /secretFUZZ
|
||
* **Other API bypasses:**
|
||
* /v3/users\_data/1234 --> 403 Forbidden
|
||
* /v1/users\_data/1234 --> 200 OK
|
||
* {“id”:111} --> 401 Unauthriozied
|
||
* {“id”:\[111]} --> 200 OK
|
||
* {“id”:111} --> 401 Unauthriozied
|
||
* {“id”:{“id”:111\}} --> 200 OK
|
||
* {"user\_id":"\<legit\_id>","user\_id":"\<victims\_id>"} (JSON Parameter Pollution)
|
||
* user\_id=ATTACKER\_ID\&user\_id=VICTIM\_ID (Parameter Pollution)
|
||
|
||
## **Parameter Manipulation**
|
||
|
||
* Change **param value**: From **`id=123` --> `id=124`**
|
||
* Add additional parameters to the URL: `?`**`id=124` —-> `id=124&isAdmin=true`**
|
||
* Remove the parameters
|
||
* Re-order parameters
|
||
* Use special characters.
|
||
* Perform boundary testing in the parameters — provide values like _-234_ or _0_ or _99999999_ (just some example values).
|
||
|
||
## **Protocol version**
|
||
|
||
If using HTTP/1.1 **try to use 1.0** or even test if it **supports 2.0**.
|
||
|
||
## **Other Bypasses**
|
||
|
||
* Get the **IP** or **CNAME** of the domain and try **contacting it directly**.
|
||
* Try to **stress the server** sending common GET requests ([It worked for this guy wit Facebook](https://medium.com/@amineaboud/story-of-a-weird-vulnerability-i-found-on-facebook-fc0875eb5125)).
|
||
* **Change the protocol**: from http to https, or for https to http
|
||
* Go to [**https://archive.org/web/**](https://archive.org/web/) and check if in the past that file was **worldwide accessible**.
|
||
|
||
## **Brute Force**
|
||
|
||
* **Guess the password**: Test the following common credentials. Do you know something about the victim? Or the CTF challenge name?
|
||
* [**Brute force**](../../generic-methodologies-and-resources/brute-force.md#http-brute)**:** Try basic, digest and NTLM auth.
|
||
|
||
{% code title="Common creds" %}
|
||
```
|
||
admin admin
|
||
admin password
|
||
admin 1234
|
||
admin admin1234
|
||
admin 123456
|
||
root toor
|
||
test test
|
||
guest guest
|
||
```
|
||
{% endcode %}
|
||
|
||
## Automatic Tools
|
||
|
||
* [https://github.com/lobuhi/byp4xx](https://github.com/lobuhi/byp4xx)
|
||
* [https://github.com/iamj0ker/bypass-403](https://github.com/iamj0ker/bypass-403)
|
||
* [https://github.com/gotr00t0day/forbiddenpass](https://github.com/gotr00t0day/forbiddenpass)
|
||
* [Burp Extension - 403 Bypasser](https://portswigger.net/bappstore/444407b96d9c4de0adb7aed89e826122)
|
||
* [Forbidden Buster](https://github.com/Sn1r/Forbidden-Buster)
|
||
|
||
<figure><img src="../../.gitbook/assets/image (1) (1) (2) (4).png" alt=""><figcaption></figcaption></figure>
|
||
|
||
[**DragonJAR Security Conference es un evento internacional de ciberseguridad**](https://www.dragonjarcon.org/) con más de una década que se celebrará el 7 y 8 de septiembre de 2023 en Bogotá, Colombia. Es un evento de gran contenido técnico donde se presentan las últimas investigaciones en español que atrae a hackers e investigadores de todo el mundo.\
|
||
¡Regístrate ahora en el siguiente enlace y no te pierdas esta gran conferencia!:
|
||
|
||
{% embed url="https://www.dragonjarcon.org/" %}
|
||
|
||
<details>
|
||
|
||
<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||
|
||
Other ways to support HackTricks:
|
||
|
||
* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/carlospolopm)**.**
|
||
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|