Agent skill · security · yaklang
401-403-bypass-techniques
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
Why this skill is useful
Adds detailed techniques and examples for bypassing access controls that are not commonly known or documented.
What it needs
About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: 401/403 Bypass Techniques — Expert Attack Playbook AI LOAD INSTRUCTION: Comprehensive 401/403 forbidden bypass techniques. Covers path normalization tricks, HTTP method override, header-based bypasses (X-Original-URL, X-Forwarded-For), protocol version tricks, and combination attacks. Base models typically know 2-3 header bypasses but miss the full matrix of path manipulation variants and verb+path combos. 0. RELATED ROUTING authbypass-authentication-flaws — broader auth bypass (login flaws, session handling) waf-bypass-techniques — when bypass is WAF-specific rather than access control http-host-header-attacks — Host header manipulation for routing bypass request-smuggling — smuggle past access controls entirely http2-specific-attacks — h2c smuggling to bypass proxy ACLs --- 1. PATH MANIPULATION BYPASSES The core idea: the reverse proxy/WAF checks one path format, but the backend normalizes differently. 1.1 Trailing Slash / Missing Slash 1.2 Case Sensitivity Works when: proxy rule is case-sensitive but backend is case-insensitive (common on Windows/IIS). 1.3 URL Encoding 1.4 Double URL Encoding 1.5 Unicode / UTF-8 Encoding 1.6 Dot-Segment / Path Traversal 1.7 Null Byte 1.8 Path Parameter Injection 1.9 Trailing Special Characters 1.10 Backslash (Windows/IIS) 1.11 Combined Path Tricks --- 2. HTTP METHOD BYPASS 2.1 Direct Method Change 2.2 Method Override Headers When the proxy blocks by method, but the backend reads override headers: 2.3 Custom / Invalid Methods --- 3. HEADER-BASED BYPASS 3.1 URL Rewrite Headers (Nginx/IIS) These headers tell the backend the "real" URL, bypassing proxy-level path checks: The proxy sees GET / (allowed), but the backend routes to /admin. 3.2 IP Spoofing Headers (Whitelist Bypass) Headers to try (each with values 127.0.0.1, 10.0.0.1, 0.0.0.0, ::1): IP encoding variants: 0177.0.0.1 (octal), 2130706433 (decimal), 0x7f000001 (hex), localhost 3.3 Other Header Tricks --- 4. PROTOCOL VERSION BYPASS --- 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/401-403-bypass-techniques