When 404 Said No… But I Said Yes — The Curious Case of 404 Bypass!
It started as a boring test on a private bug bounty target — an internal SaaS tool that responded to every /admin, /config, /backup with a beautiful...
404 Not Found.
As you all know, what is 404 bypass? I don’t want to waste your precious time, because if I waste your time here, you might not be able to hack the entire world ……….. just a joke. Don’t get angry…… Continue reading😏
But something felt wrong.
A small hint: the server took suspiciously longer to respond to some 404 requests.
Hmm… why would a non-existent page take time to die?
The First Crack — 404 But… Delayed?
Using Burp Intruder, I sent:
/admin → 404 (Time: 120ms)
/admin/ → 404 (Time: 130ms)
/admin/. → 404 (Time: 130ms)
/admin? → 404 (Time: 300ms) Wait — why was the query-param request slower?
Time-based differences can mean:
✔️ Backend processing
✔️ File system check
✔️ Reverse proxy misrouting
Could be Apache/Nginx wildcards mishandling or even a misconfigured Express.js server.
Breaking Through — The Real Bypass Starts
So I tested deeper:
/admin/%2e%2e/
/admin/..;/ (Nginx/Apache weak separator bypass)
/admin/.random (Some devs leave backup files like `.backup`)
/admin;/. (Tomcat or WildFly dirty trick)All the responses are 404.
But then…
/admin;/test
→ 403 Forbidden? 🤔 (Interesting, not 404!)We’re cracking it — if this was 403, maybe something lives here after all.
The Shot That Landed — UTF-8 Bypass to Glory
I remembered some rare Nginx behavior.
Get Muthu’s stories in your inbox
Join Medium for free to get updates from this writer.
Tried:
/admin/%2e/
/admin/%2f/ (encoded forward slash)BAM! 500 Internal Server Error.
Wait — we touched something the server didn’t expect.
So I tried:
/admin/%2e%2e%2f (URL-encoded ../ traversal)
→ 200 OK 🔥🔥🔥No kidding — the hidden admin panel, fully alive.
404 was fake. It was hiding the real thing behind unsafe decoding!
Why Is This Dangerous?
✔Bypassed Access Control using encoded path traversal.
✔Accessed hidden admin endpoints meant only for backend/internal use.
✔ Possible to reach backup configs, internal dashboards, forgotten dev files.
On that panel:
- Old user DB backups were downloadable.
- Debug logs were exposed.
- Even an open file upload feature existed — that could have led to RCE (Remote Code Execution).
Why Did This Happen? (Root Cause)
❌ Poor URL normalization in server routing (probably Nginx/PHP/Apache misconfigured).
❌ Some frameworks double-decode or misinterpret encoded characters (UTF-8, %2f, etc.).
❌ Reverse proxy (NGINX) forwards the broken path to backend apps — blindly trusting the URL.
