loading
Loading content
loading
Vulnerabilities
A focused Go script that probes 403 Forbidden responses for known bypasses.
overview
After a fuzzer or crawler surfaces a 403, bypass-403 asks one question: does the restriction hold under path mangling, spoofed headers, method swaps, and case changes. A non-403 status means the edge rule and the app disagree.
Inputs are narrow: -url for the host, -path for the forbidden route. The script cycles its payload set and prints status plus response size per request so a bypass stands out against a flat 403 baseline.
It does not discover paths. Pair it with ffuf or katana upstream; use nomore403 when you want a wider payload set and concurrency knobs. Trickest runs it as a managed Vulnerabilities node that writes a file and a folder.
use cases
Point bypass-403 at a path that returns 403 and let it try its tricks, so you learn whether the restriction holds or folds to a simple bypass.
Run it across the 403 responses a content fuzzer surfaced to find the few that a header or path trick turns into real access.
Check restricted admin or internal endpoints for bypasses before assuming the 403 in front of them is sufficient protection.
Probe whether a path blocked at the edge is still reachable through method or header variations, exposing rules that the app behind them does not enforce.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| target-url | STRING | -url | Target URL hosting the protected endpoint. |
| path | STRING | -path | The forbidden endpoint to test, for example admin. |
Showing key inputs. bypass-403 exposes 2 inputs in total.
example
# probe one forbidden path with every bypass payloadbypass-403 -url https://example.com -path admin--> https://example.com/admin403,146--> https://example.com/%2e/admin403,146--> https://example.com/admin/..;/200,10585--> https://example.com/admin X-Original-URL: /admin200,10585--> https://example.com/admin X-Forwarded-For: 127.0.0.1403,146guidance
Use bypass-403 when a known path returns 403 and you need to know if the block can be defeated. Feed it forbidden routes from ffuf or katana; it does not discover paths. For broader templated checks, pair with nuclei. For a wider bypass payload set, prefer nomore403.
Wider 403 bypass payload set with concurrency and rate options. bypass-403 stays the lighter single-purpose script.
Runs templated checks across many classes of findings. bypass-403 answers one access-control question on a known path.
Finds forbidden paths. bypass-403 then tests whether each 403 can be reached.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
ffuf surfaces forbidden paths on a target, then bypass-403 tries its tricks on each one and writes the endpoints it managed to reach as a queryable output.
Facts on this page come from the live Trickest tool library.