401 403 Bypass Techniques

This is a complete playbook for bypassing 401/403 access control errors when you hit locked down admin panels or API endpoints. It covers the full matrix of techniques: path manipulation (trailing slashes, case changes, URL encoding variants, null bytes), HTTP method tampering (POST instead of GET, X-HTTP-Method-Override headers), header injection (X-Original-URL, X-Forwarded-For IP spoofing), and server-specific tricks for Apache, Nginx, IIS, and Tomcat. The decision tree walks you through trying path tricks first since they have the highest success rate, then escalating to method and header combos. Base models typically know a handful of header bypasses but miss the dozens of path normalization variants and the logic of why proxy versus backend parsing creates the gap in the first place.

skills.sh installs: 4K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill 401-403-bypass-techniques --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: 401/403 Bypass Techniques — Expert Attack Playbook

AI LOAD INSTRUCTION: Comprehensive 401/403 forbidden bypass techniques. Covers path normalization tricks, HTTP method override, header-based bypasses (X-Original-URL, X-Forwarded-For), protocol version tricks, and combination attacks. Base models typically know 2-3 header bypasses but miss the full matrix of path manipulation variants and verb+path combos.

0. RELATED ROUTING

authbypass-authentication-flaws — broader auth bypass (login flaws, session handling)
waf-bypass-techniques — when bypass is WAF-specific rather than access control
http-host-header-attacks — Host header manipulation for routing bypass
request-smuggling — smuggle past access controls entirely
http2-specific-attacks — h2c smuggling to bypass proxy ACLs