Which 403 bypass techniques does nomore403 run?

The default set is verbs, verbs-case, headers, endpaths, midpaths, double-encoding, http-versions, and path-case. Pass --technique to run only the ones you want, for example --technique headers,path-case, or leave it unset to try them all.

Can it bypass a 403 with a spoofed IP or custom headers?

Yes. The --bypass-ip flag injects an address into headers such as X-Forwarded-For, so you can test whether an internal-only rule trusts a client-supplied IP. Add --header for your own header tricks, or --random-agent to rotate the User-Agent.

How do I avoid tripping rate limits while testing?

Pace the run with --delay to space out requests and --max-goroutines to cap concurrency, then set --rate-limit so nomore403 halts the moment a target answers 429.

What should feed nomore403 in a workflow?

A content-discovery stage. Run dirsearch, ffuf, or a crawler first to surface the 403 paths, then hand that URL list to nomore403 so every forbidden endpoint gets a bypass attempt. It tests access, it does not discover paths, so it works from a list a fuzzer already produced.

Updated Jul 14, 2026

Scanners

Bypass 403 and 40X blocks to reach forbidden endpoints

Bypass 403/40X restrictions through smart request manipulation.

Test forbidden endpoints for bypasses Spoof a trusted source IP Scope the technique set

overview

What nomore403 does

nomore403 targets endpoints that answer 403 or another 40X and tries to reach the content anyway by reshaping the request in ways the access rule may not account for. It cycles through verb and verb-case tampering, header injection, end-path and mid-path mutations, double URL encoding, HTTP-version swaps, and path-case changes, then reports which technique, if any, returned a body instead of the block.

The run is yours to shape. Pick a subset of techniques with --technique or run the full default set, spoof a trusted source with --bypass-ip so an internal-only rule sees an allowed X-Forwarded-For address, and add your own --header or --user-agent. --status filters the output down to the codes that signal a hit, while --delay, --max-goroutines, and the --rate-limit halt keep the scan from tripping a 429.

In a Trickest workflow it reads a file of forbidden URLs, the ones a fuzzer or crawler already flagged as 403, and writes the results as a file and folder you can query. Wire it after a content-discovery stage so every path the server tried to protect gets a bypass attempt, and schedule the workflow to re-test as access rules change.

source github.com/devploit/nomore403

use cases

Where nomore403 fits

Test forbidden endpoints for bypasses

Feed nomore403 the 403 paths a fuzzer found to see whether verb, header, or encoding tricks reach the content the server meant to block.

Spoof a trusted source IP

Use bypass-ip to inject an address into forwarding headers, testing whether an internal-only restriction trusts a client-supplied IP.

Scope the technique set

Run a chosen subset of techniques instead of all of them to keep output focused when you already suspect a particular weakness.

Stay within rate limits

Set a delay and goroutine cap and enable the rate-limit halt so the run backs off cleanly when a target returns 429.

reference

nomore403 inputs and flags

20 inputs

Name	Type	Flag	Description
urls	FILE	·	File of target URLs to test for a bypass.
technique	STRING	--technique	One or more bypass techniques to run (e.g. verbs, headers, path-case); defaults to the full set.
bypass-ip	STRING	--bypass-ip	IP or hostname injected into trust headers like X-Forwarded-For.
header	STRING	--header	Add one or more custom headers; repeatable flag.
http-method	STRING	--http-method	HTTP method for the request, for verb tampering (default GET).
status	STRING	--status	Filter output to comma-separated status codes (e.g. 200,301,403).
max-goroutines	STRING	--max-goroutines	Cap concurrent goroutines to manage load (default 50).
delay	STRING	--delay	Delay between requests in milliseconds (default 0).

Showing key inputs. nomore403 exposes 20 inputs in total.

Full flag reference (20 inputs)

Name	Type	Flag	Description
http	BOOLEAN	--http	Use HTTP instead of HTTPS for requests defined in the request file.
urls	FILE	·	Specify the target URLs.
delay	STRING	--delay	Specify a delay between requests in milliseconds. Helps manage request rate (default: 0ms).
proxy	STRING	--proxy	Specify a proxy server for requests (e.g., 'http://server:port').
folder	FOLDER	--folder	Specify the folder location for payloads if not in the same directory as the executable.
header	STRING	--header	Add one or more custom headers to requests. Repeatable flag for multiple headers.
status	STRING	--status	Filter output by comma-separated status codes (e.g., 200,301,403).
unique	BOOLEAN	--unique	Show unique output based on status code and response length.
timeout	STRING	--timeout	Specify a max timeout time in ms (default 6000).
verbose	BOOLEAN	--verbose	Enable verbose output for detailed request/response logging (not based on auto-calibrate).
redirect	BOOLEAN	--redirect	Automatically follow redirects in responses.
bypass-ip	STRING	--bypass-ip	Use a specified IP address or hostname for bypassing access controls. Injects this IP in headers like 'X-Forwarded-For'.
no-banner	BOOLEAN	--no-banner	Disable the display of the startup banner (default: banner shown).
technique	STRING	--technique	Specify one or more attack techniques to use (e.g., headers,path-case). Default: verbs,verbs-case,headers,endpaths,midpaths,double-encoding,http-versions,path-case.
rate-limit	BOOLEAN	--rate-limit	Halt requests upon encountering a 429 (rate limit) HTTP status code.
user-agent	STRING	--user-agent	Specify a custom User-Agent string for requests (default: 'nomore403').
http-method	STRING	--http-method	Specify the HTTP method for the request (e.g., GET, POST). Default is 'GET'.
random-agent	BOOLEAN	--random-agent	Enable the use of a randomly selected User-Agent.
request-file	FILE	--request-file	Load request configuration and flags from a specified file.
max-goroutines	STRING	--max-goroutines	Limit the maximum number of concurrent goroutines to manage load (default: 50).

example

Run nomore403

nomore403 · command

# rotate 403-bypass techniques against a forbidden path and spoof a trusted IPnomore403 -u https://example.com/admin \  --technique verbs,headers,path-case,double-encoding \  --bypass-ip 127.0.0.1 \  --status 200,301,302

sample output

BASELINE  default            403    512 bytes   https://example.com/admin FINDINGS  headers       100!  200   4096 bytes   X-Forwarded-For: 127.0.0.1  headers        79.  200   4096 bytes   X-Original-URL: /admin  path-case      35.  200   1163 bytes   /Admin  midpaths       18.  200    964 bytes   /./admin  verbs           9.  405    182 bytes   POST /admin  http-versions   3.  400    140 bytes   HTTP/1.0

guidance

Choosing nomore403

Use nomore403 when a path returns 403 and you want to know whether a misconfiguration leaves it reachable. It is a focused bypass tester, not a discovery tool, so feed it forbidden URLs from a fuzzer or crawler and filter the output to the status codes that signal a hit.

bypass-403

Another 403 bypass tester. nomore403 carries a broader technique set with auto-calibration and IP spoofing.

dirsearch

Finds the forbidden paths in the first place. Run it ahead of nomore403, then test the 403 hits for bypasses.

ffuf

Content-discovery fuzzer that surfaces 403 endpoints worth handing to nomore403 for bypass testing.

faq

nomore403 questions

Point nomore403 at the forbidden URL and it reshapes the request until a mutation slips past the access rule: it tampers with the HTTP verb and its case, injects headers such as X-Forwarded-For, rewrites the path case, adds end-path and mid-path characters, double-encodes the URL, and swaps the HTTP version. It then reports which technique returned a body instead of the block.

Run nomore403 yourself

ffuf surfaces forbidden paths, then nomore403 tries bypass techniques against the 403 endpoints and writes the reachable ones as a queryable output.

Run nomore403 in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

urls

FILE

File of target URLs to test for a bypass.

technique

STRING

--technique

One or more bypass techniques to run (e.g. verbs, headers, path-case); defaults to the full set.

bypass-ip

STRING

--bypass-ip

IP or hostname injected into trust headers like X-Forwarded-For.

header

STRING

--header

Add one or more custom headers; repeatable flag.

http-method

STRING

--http-method

HTTP method for the request, for verb tampering (default GET).

status

STRING

--status

Filter output to comma-separated status codes (e.g. 200,301,403).

max-goroutines

STRING

--max-goroutines

Cap concurrent goroutines to manage load (default 50).

delay

STRING

--delay

Delay between requests in milliseconds (default 0).

Name

Type

Flag

Description

http

BOOLEAN

--http

Use HTTP instead of HTTPS for requests defined in the request file.

urls

FILE

Specify the target URLs.

delay

STRING

--delay

Specify a delay between requests in milliseconds. Helps manage request rate (default: 0ms).

proxy

STRING

--proxy

Specify a proxy server for requests (e.g., 'http://server:port').

folder

FOLDER

--folder

Specify the folder location for payloads if not in the same directory as the executable.

header

STRING

--header

Add one or more custom headers to requests. Repeatable flag for multiple headers.

status

STRING

--status

Filter output by comma-separated status codes (e.g., 200,301,403).

unique

BOOLEAN

--unique

Show unique output based on status code and response length.

timeout

STRING

--timeout

Specify a max timeout time in ms (default 6000).

verbose

BOOLEAN

--verbose

Enable verbose output for detailed request/response logging (not based on auto-calibrate).

redirect

BOOLEAN

--redirect

Automatically follow redirects in responses.

bypass-ip

STRING

--bypass-ip

Use a specified IP address or hostname for bypassing access controls. Injects this IP in headers like 'X-Forwarded-For'.

no-banner

BOOLEAN

--no-banner

Disable the display of the startup banner (default: banner shown).

technique

STRING

--technique

Specify one or more attack techniques to use (e.g., headers,path-case). Default: verbs,verbs-case,headers,endpaths,midpaths,double-encoding,http-versions,path-case.

rate-limit

BOOLEAN

--rate-limit

Halt requests upon encountering a 429 (rate limit) HTTP status code.

user-agent

STRING

--user-agent

Specify a custom User-Agent string for requests (default: 'nomore403').

http-method

STRING

--http-method

Specify the HTTP method for the request (e.g., GET, POST). Default is 'GET'.

random-agent

BOOLEAN

--random-agent

Enable the use of a randomly selected User-Agent.

request-file

FILE

--request-file

Load request configuration and flags from a specified file.

max-goroutines

STRING

--max-goroutines

Limit the maximum number of concurrent goroutines to manage load (default: 50).

# rotate 403-bypass techniques against a forbidden path and spoof a trusted IPnomore403 -u https://example.com/admin \ --technique verbs,headers,path-case,double-encoding \ --bypass-ip 127.0.0.1 \ --status 200,301,302

BASELINE default 403 512 bytes https://example.com/admin FINDINGS headers 100! 200 4096 bytes X-Forwarded-For: 127.0.0.1 headers 79. 200 4096 bytes X-Original-URL: /admin path-case 35. 200 1163 bytes /Admin midpaths 18. 200 964 bytes /./admin verbs 9. 405 182 bytes POST /admin http-versions 3. 400 140 bytes HTTP/1.0

Bypass 403 and 40X blocks to reach forbidden endpoints

What nomore403 does

Where nomore403 fits

Test forbidden endpoints for bypasses

Spoof a trusted source IP

Scope the technique set

Stay within rate limits

nomore403 inputs and flags

Run nomore403

Choosing nomore403

bypass-403

dirsearch

ffuf

nomore403 questions

More Scanners tools

airixss

alterx

bomber

broken-link-checker

chopchop

cmseek

Run nomore403 yourself

Bypass 403 and 40X blocks to reach forbidden endpoints

What nomore403 does

Where nomore403 fits

Test forbidden endpoints for bypasses

Spoof a trusted source IP

Scope the technique set

Stay within rate limits

nomore403 inputs and flags

Run nomore403

Choosing nomore403

bypass-403

dirsearch

ffuf

nomore403 questions

More Scanners tools

airixss

alterx

bomber

broken-link-checker

chopchop

cmseek

Run nomore403 yourself