Adoption

Agent Skills are supported by leading AI development tools.

VS Code Gemini CLI GitHub Goose Amp Cursor Claude Code Letta OpenCode Claude OpenAI Codex Factory VS Code Gemini CLI GitHub Goose Amp Cursor Claude Code Letta OpenCode Claude OpenAI Codex Factory

wgpsec/401-403-bypass

Name: 401-403-bypass
Author: wgpsec

skills/exploit/auth/401-403-bypass/SKILL.md

npx skillsauth add wgpsec/AboutSecurity 401-403-bypass

Clean

TrivyContainer and dependency vulnerability scanner

Clean

SemgrepStatic code analysis for vulnerabilities

Clean

mcp-scan (Snyk)Model Context Protocol security validation

Skipped

Snyk (dep)Open source security scanning

Skipped

Socket.devSupply chain security analysis

Skipped

VirusTotalMulti-engine malware detection

Skipped

CrowdStrikeAdvanced threat intelligence

Skipped

OSV-ScannerOpen Source Vulnerability database check

Skipped

OWASP Dep-Check

401/403 绕过方法论

核心思路：反向代理/WAF 检查一种路径格式，但后端做了不同的路径规范化。

深入参考

路径操纵 Payload 完整列表 → references/path-manipulation-payloads.md
HTTP 方法/Header 绕过 → references/method-header-bypass.md
中间件特定绕过与组合攻击 → references/middleware-combo-bypass.md

决策树

遇到 401/403？
├── 1. 路径操纵（成功率最高）
│   ├── /path/ → /PATH → /path%20 → /./path → //path
│   ├── /path;x → /path..;/ → /%2e/path → /path%00
│   └── 200？→ 绕过成功
├── 2. 方法绕过
│   ├── POST/PUT/PATCH/DELETE/OPTIONS/HEAD
│   ├── X-HTTP-Method-Override: PUT
│   └── PROPFIND/自定义方法
├── 3. Header 绕过
│   ├── X-Original-URL: /path（Nginx/IIS）
│   ├── X-Forwarded-For: 127.0.0.1（IP 白名单）
│   └── Referer/Origin/Host 伪造
├── 4. 协议绕过
│   └── HTTP/1.0
├── 5. 组合攻击
│   └── Method + Path + Header 三合一
├── 全部失败 → 其他思路
│   ├── 请求走私 → cache-poisoning-smuggling
│   ├── SSRF → ssrf-methodology
│   ├── IDOR → idor-methodology
│   └── 认证逻辑 → privilege-escalation-web
└── 自动化扫描 byp4xx / 403bypasser

快速参考 — 路径操纵要点

| 技巧 | 示例 | |------|------| | 尾部斜杠/点 | /admin/ /admin/. | | 大小写 | /Admin /ADMIN | | URL 编码 | /%61dmin /admi%6e | | 双重编码 | /%2561dmin | | Unicode 过长编码 | /admi%C0%AE | | 点段/路径穿越 | /./admin //admin | | NULL 字节 | /admin%00 /admin%00.json | | 路径参数 (Tomcat) | /admin;foo /;/admin | | 反斜杠 (IIS) | /admin\ |

快速参考 — 方法/Header 要点

| 技巧 | 示例 | |------|------| | 方法切换 | POST /admin PUT /admin | | Method Override | X-HTTP-Method-Override: PUT | | URL 重写 | X-Original-URL: /admin | | IP 伪造 | X-Forwarded-For: 127.0.0.1 | | 协议降级 | GET /admin HTTP/1.0 |

中间件速查

| 服务器 | 关键技巧 | |---|---| | Apache | /admin/(尾部斜杠), /.admin(点前缀) | | Nginx | /Admin(大小写), X-Original-URL | | IIS/ASP.NET | /admin;.css, /admin\, /admin::$DATA | | Tomcat/Java | /admin;foo, /admin..;/, /;/admin | | Spring | /admin.anything(旧版后缀匹配) |

完整 payload 列表见 references 文件

wgpsec/401-403-bypass

skills/exploit/auth/401-403-bypass/SKILL.md

401/403 访问拒绝绕过方法论。当遇到管理后台、API 端点返回 401/403 Forbidden 时使用。覆盖路径操纵、HTTP 方法篡改、Header 注入、协议降级、组合攻击

1,185 stars

development

Updated Apr 24, 2026

$ install --global

skillsauth

npx skillsauth add wgpsec/AboutSecurity 401-403-bypass

Install this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.

Security Scan Results

3 of 9 scanners reported clean

Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.

Scanners Passed

Scanners in report

Clean

TrivyContainer and dependency vulnerability scanner

95%

Clean

SemgrepStatic code analysis for vulnerabilities

95%

Clean

mcp-scan (Snyk)Model Context Protocol security validation

95%

Skipped

Snyk (dep)Open source security scanning

50%

Skipped

Socket.devSupply chain security analysis

50%

Skipped

VirusTotalMulti-engine malware detection

50%

Skipped

CrowdStrikeAdvanced threat intelligence

50%

Skipped

OSV-ScannerOpen Source Vulnerability database check

50%

Skipped

OWASP Dep-Check

50%

Last scanned: Apr 27, 2026, 10:07 PM136.2s1 file scanned

SKILL.md

name:: 401-403-bypass
description:: 401/403 访问拒绝绕过方法论。当遇到管理后台、API 端点返回 401/403 Forbidden 时使用。覆盖路径操纵、HTTP 方法篡改、Header 注入、协议降级、组合攻击
tags:: 403,401,bypass,forbidden,绕过,路径操纵,method override,X-Original-URL,X-Forwarded-For,access control,权限绕过
category:: exploit

401/403 绕过方法论

核心思路：反向代理/WAF 检查一种路径格式，但后端做了不同的路径规范化。

深入参考

路径操纵 Payload 完整列表 → references/path-manipulation-payloads.md
HTTP 方法/Header 绕过 → references/method-header-bypass.md
中间件特定绕过与组合攻击 → references/middleware-combo-bypass.md

决策树

遇到 401/403？
├── 1. 路径操纵（成功率最高）
│   ├── /path/ → /PATH → /path%20 → /./path → //path
│   ├── /path;x → /path..;/ → /%2e/path → /path%00
│   └── 200？→ 绕过成功
├── 2. 方法绕过
│   ├── POST/PUT/PATCH/DELETE/OPTIONS/HEAD
│   ├── X-HTTP-Method-Override: PUT
│   └── PROPFIND/自定义方法
├── 3. Header 绕过
│   ├── X-Original-URL: /path（Nginx/IIS）
│   ├── X-Forwarded-For: 127.0.0.1（IP 白名单）
│   └── Referer/Origin/Host 伪造
├── 4. 协议绕过
│   └── HTTP/1.0
├── 5. 组合攻击
│   └── Method + Path + Header 三合一
├── 全部失败 → 其他思路
│   ├── 请求走私 → cache-poisoning-smuggling
│   ├── SSRF → ssrf-methodology
│   ├── IDOR → idor-methodology
│   └── 认证逻辑 → privilege-escalation-web
└── 自动化扫描 byp4xx / 403bypasser

快速参考 — 路径操纵要点

快速参考 — 方法/Header 要点

中间件速查

完整 payload 列表见 references 文件

Related Skills

wgpsec/azure-pentesting

testing

VerifiedTrustedCommunity

Azure 云环境渗透测试总体方法论。当目标使用 Azure/Microsoft 365/Entra ID、发现 Azure 相关资产（Blob Storage/App Service/Azure VM/Azure Functions）、获取 Azure 凭据（Service Principal/Managed Identity/Access Token）、或需要对 Azure 环境进行安全评估时使用。提供从未授权枚举到 Entra ID 攻击、服务提权、Cloud-to-OnPrem 横向移动的全流程决策树。覆盖 35+ Azure 服务攻击面

1,393SKILL.mdUpdated Apr 24, 2026

wgpsec/azure-pentesting

wgpsec/mythic-c2

tools

VerifiedTrustedCommunity

Mythic C2 操作方法论。当需要部署 Mythic、选择 Mythic Agent、安装 C2 Profile、配置 HTTP/DNS/WebSocket/SMB/TCP 通信、生成 payload、管理回连任务，或把 Mythic 作为跨平台 C2 框架用于授权红队演练时使用。覆盖 mythic-cli 安装、Agent/Profile 选择、SSL 证书配置、payload 构建和基础 OPSEC 判断

1,345SKILL.mdUpdated May 22, 2026

wgpsec/docker-pentesting

development

VerifiedTrustedCommunity

Docker 安全测试与容器渗透方法论。当需要评估 Docker 容器、Docker Daemon、Docker Registry、镜像层、构建产物或容器逃逸风险时使用。覆盖容器环境识别、特权容器逃逸、docker.sock/Remote API 利用、procfs/cgroup/capabilities 滥用、Docker 用户组提权、运行时/内核 CVE、Registry 枚举、镜像层 Secret 分析和构建上下文泄露。发现 Docker 容器环境、Registry 暴露、镜像凭据或容器配置错误时应使用此技能

1,345SKILL.mdUpdated May 22, 2026

wgpsec/docker-pentesting

wgpsec/padbuster-padding-oracle

development

VerifiedTrustedCommunity

使用 PadBuster 进行 Padding Oracle 攻击。当发现 Web 应用使用 CBC 模式加密且存在 Padding Oracle 漏洞时使用。PadBuster 可自动解密密文和伪造任意明文对应的合法密文，适用于加密 Cookie/Token/URL 参数。任何涉及 Padding Oracle 攻击、CBC 密文解密、Cookie 伪造的场景都应使用此技能

1,345SKILL.mdUpdated May 6, 2026

wgpsec/padbuster-padding-oracle

Download

For Claude Desktop. Download once, then upload the file in the app — no terminal needed.

Need help? View full Cowork setup guide →

Install manually

Choose your platform

# Clone the repo
git clone https://github.com/wgpsec/AboutSecurity.git

# Copy into Claude Code skills folder (global)
cp -r AboutSecurity/skills/exploit/auth/401-403-bypass ~/.claude/skills/

Claude Code Skills — official skills path docs.

Repository

wgpsec/AboutSecurity

1,185 stars

Compatible with

Claude Code

OpenAI Codex CLI

ChatGPT