401-403-bypass-techniques

An expert attack playbook for bypassing 401/403 access-denied responses during security testing. Use it when you hit access-denied on admin panels, API endpoints, or restricted paths and want a systematic matrix of bypass techniques rather than the handful of header tricks most people remember.

Its largest section is path manipulation, which exploits cases where a reverse proxy or WAF checks one path format but the backend normalizes another: trailing slash or dot, case variation, single and double URL encoding, overlong Unicode/UTF-8, dot-segment and traversal sequences, null bytes, path-parameter injection for Tomcat and Java, backslashes on IIS, and combinations of these. It then covers HTTP method bypass, including swapping GET for POST, PUT, PATCH, DELETE, OPTIONS, or HEAD, method-override headers such as X-HTTP-Method-Override and the Rails or Laravel method body field, and custom or WebDAV methods.

Header-based bypasses include URL-rewrite headers (X-Original-URL, X-Rewrite-URL) that make the proxy see an allowed path while the backend routes elsewhere, IP-spoofing headers (X-Forwarded-For, X-Real-IP, True-Client-IP and many more, with localhost values and octal, decimal, or hex encodings), and Referer, Origin, and Host tricks. It also documents protocol-version downgrades (HTTP/1.0, HTTP/0.9, HTTP/2 pseudo-headers) and verb-plus-path combination attacks that stack techniques for a higher success rate. A technology-specific table gives targeted tricks for Apache, Nginx, IIS/ASP.NET, Tomcat/Java, and Spring, followed by automated tooling (byp4xx, 403bypasser, dirsearch, feroxbuster, and Burp Intruder) and a decision tree that recommends starting with path manipulation before moving to method and header bypasses.