Home

Awesome

forthebadge made-with-python License: MIT

403bypasser

Banner

Türkçe

403bypasser, hedef sayfalardaki erişim kontrolü kısıtlamalarını aşmak için kullanılan teknikleri otomatikleştirir. Bu araç geliştirilmeye devam edecektir, katkılara açıktır.

English

403bypasser automates the techniques used to circumvent access control restrictions on target pages. 403bypasser will continue to be improved and it is open to contributions.

Installation

  1. Clone the repository to your machine. git clone https://github.com/yunemse48/403bypasser.git
  2. Install required modules by running the code pip install -r requirements.txt
  3. READY!

Usage

Arguments:<br>

ArgumentDescriptionExamplesNote
-usingle URL to scanhttp://example.com or http://example.com/All these example usages are interpreted in the same way
-Upath to list of URLs./urllist.txt, ../../urllist.txt, etc.Just provide the path where the file is located :)
-dsingle directory to scanadmin or /admin or admin/ or /admin/All these example usages are interpreted in the same way
-Dpath to list of directories./dirlist.txt, ../../dirlist.txt, etc.Just provide the path where the file is located :)

Usage 1: python3 403bypasser.py -u https://example.com -d /secret<br> Usage 2: python3 403bypasser.py -u https://example.com -D dirlist.txt<br> Usage 3: python3 403bypasser.py -U urllist.txt -d /secret<br> Usage 4: python3 403bypasser.py -U urllist.txt -D dirlist.txt<br>

IMPORTANT NOTE: All the followings are interpreted the same. Therefore, which pattern you use is just a matter of preference.

Since Python is a cross-platform language, one can run this program on different operating systems.

Output

The output of the program is saved (in the current directory) in a file with the name of the domain name given as input.<br> For example: <br> python3 403bypasser.py -u https://example.com -d /secret is given. Then the output is saved to example.txt in the current directory.

Release Notes

Changes in v2.0: Considerable changes have been done in this version. The project is completely moved to Python 3 from Bash. New and wide variety of techniques have been added.<br> <br> Changes in v1.1: It's now possible to pass files (lists) to 403bypasser as input via arguments. Furthermore, two more test cases added: poisoning with 1)X-Original-URL and 2)X-Rewrite-URL headers.

To-Do List

Which Cases Does This Tool Check?

1. Request Method Manipulation

2. Path Manipulation

3. Overriding the Target URL via Non-Standard Headers

4. Other Headers & Values

Headers:

Values: