shelld3v
commented
3 years ago I recently found this bypass. I got this directory /plesk-stat status code 301 (dirsearch) but when I opened it showing 403 Forbidden.
Chrome follows the redirect, but dirsearch doesn't. If you want, then use the -F flag
And if some websites are not enabled directory listing that means the website is not misconfigured. but it is. so decided to submit these directories names which you should include in your list for bypass 403 restriction.
There are really few servers are opening for directory listing, but you know how people still able to find deep files and dirs? There is a technique, that dirsearch supports, called recursion. If folder folder/ exists, 99.99% of webservers will redirect you to http://target/folder/ when you hit http://target/folder. So from here, you can keep brute-forcing http://target/folder/ until finding another folder or file. By using the -r flag, you can have dirsearch scan recursively. You can try now with your target, and give me the feedback.
Of course, the scanning result depends a lot on your wordlist, so try having a good wordlist (dirsearch default is not bad)
Btw, I will still add those endpoints to dirsearch wordlist
dipakpanchal05
What is the feature?
403 Bypass Plesk-stat
What is it?
I recently found this bypass. I got this directory /plesk-stat status code 301 (dirsearch) but when I opened it showing 403 Forbidden. Then I use dork. index of/plesk-stat
I found some directories. Listed Below.
/plesk-stat/anon_ftpstat/ /plesk-stat/ftpstat/ /webstat-ssl/ /webstat/
What is the use case?
In some cases user not aware of this functionality of Plesk-stat. And if some websites are not enabled directory listing that means the website is not misconfigured. but it is. so decided to submit these directories names which you should include in your list for bypass 403 restriction.
When and who will use this? Why this matters?
This matters because in very rare cases directory listing enabled. And these directories bypass the restriction and will give the result as we want.