403 Bypass Techniques for Bug Bounty

All About 403 Bypass Techniques and Tools

Today, I’ll be sharing with you how to bypass the 403 status code you might encounter on websites.

What is a 403 Status Code and Why Do We Encounter It?

The 403 status code restricts users from accessing certain hosts, endpoints, etc. This restriction can be implemented either in the website’s code or through WAF (Web Application Firewall) rules set by the site owner. In short, these are the pages the website’s administrator does not want you to access.

Now let’s talk about how we can bypass these 403 pages.

Note: These methods do not always work.

Topics Covered in This Article:

• Applying special characters to URLs
• Changing HTTP methods
• Header manipulation
• Bypassing with automated tools

1. Applying Special Characters to URLs

Let’s say you try to access a page like https://target.com/admin and are met with a 403 Forbidden response. In this case, we can attempt to bypass it by manipulating the URL. For example:

/admin%20  
/admin..

Try:
https://target.com/admin%20 – and you might get a 200 status code 😉

Get Tuncay Abulfatzada’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

You can find more payloads in my Telegram channel:
📌 Telegram: https://t.me/silverxvip

2. Changing HTTP Methods

In this method, we test different HTTP request methods (GET, POST, PUT, DELETE, etc.) on the page returning the 403 Forbidden status. Burp Suite can speed up this process.

1. Capture the request in Burp Repeater.
2. Send it to Intruder.
3. Select the part where the method is written (e.g., GET), add it as a position, and fuzz it.
4. Add payloads such as POST, DELETE, PUT, etc.

If you receive a 200 status code, the bypass was successful 😉

3. Header Manipulation

Sometimes the server may allow access only from local IPs. In such cases, header manipulation can help bypass restrictions.

1. Open Burp Suite and intercept the request.
2. Send the request to Intruder.
3. Add headers like:

X-Forwarded-For: 127.0.0.1  
X-Forwarded-For-Original: 127.0.0.1  
X-Forwarded-Host: 127.0.0.1

1. Use the Sniper attack type in Burp Intruder.
2. Add your header payloads and start fuzzing.

If you get a 200 status code, it means your bypass method worked 🙂

4. Bypassing with Automated Tools

All the methods above can also be used with automated tools.

1. ffuf

ffuf is one of the best tools for fuzzing. Here’s how you can test a 403 bypass using it:

ffuf -u https://target.com/adminFUZZ -w 403-bypass-wordlist.txt -mc 200

FUZZ is the placeholder where the payloads will be tested. Only results that return a 200 status code will be shown. You can also add filters based on the size or structure of the 403 response.

GitHub: https://github.com/ffuf/ffuf

2. bypass-403

Run it like this:

./bypass-403.sh https://target.com admin

First, provide the target URL, then the endpoint. The tool will automatically apply various payloads to attempt bypassing the 403 restriction.

GitHub: https://github.com/iamj0ker/bypass-403

3. 403-bypasser (Burp Extension)

This is one of my most frequently used Burp Suite extensions.

• You can easily install it from the Burp Extensions section.
• It supports header bypass and more.