BypassFuzzer: Fuzz 401/403/404 pages for bypasses
Bypass Fuzzer
Fuzz 401/403ing endpoints for bypasses
This tool performs various checks via headers, path normalization, verbs, etc. to attempt to bypass ACLs or URL validation.
It will output the response codes and length for each request, in a nicely organized, color-coded way so things are readable.
I implemented a “Smart Filter” that lets you mute responses that look the same after a certain number of times.
You can now feed it raw HTTP requests that you save to a file from Burp.
Download
git clone https://github.com/intrudir/BypassFuzzer.git
Use
Specifying a request to test
Best method: Feed it a raw HTTP request from Burp!
Simply paste the request into a file and run the script!
- It will parse and use cookies & headers from the request.
- The easiest way to authenticate your requests
python3 bypassfuzzer.py -r request.txt
Using other flags
Specify a URL
python3 bypassfuzzer.py -u http://example.com/test1/test2/test3/forbidden.html
some examples:
–cookies “cookie1=blah“
-c “cookie1=blah; cookie2=blah“
bypassfuzzer.py -u https://example.com/forbidden -m PUT -d “param1=blah¶m2=blah2”
Specify custom headers to use with every request Maybe you need to add some kind of auth header like Authorization: bearer <token>
Specify -H “header: value” for each additional header, you’d like to add:
bypassfuzzer.py -u https://example.com/forbidden -H “Some-Header: blah“ -H “Authorization: Bearer 1234567“
Smart filter feature!
Based on the response code and length. If it sees a response 8 times or more it will automatically mute it.
Repeats are changeable in the code until I add an option to specify it in a flag
NOTE: Can’t be used simultaneously with -hc or -hl (yet)
# toggle smart filter on
bypassfuzzer.py -u https://example.com/forbidden –smart
Specify a proxy to use
Useful if you wanna a proxy through Burp
bypassfuzzer.py -u https://example.com/forbidden –proxy http://127.0.0.1:8080
Skip sending header payloads or url payloads
[pastacode lang=”markup” message=”” highlight=”” provider=”manual” manual=”%23%20skip%20sending%20headers%20payloads%0Abypassfuzzer.py%20-u%20https%3A%2F%2Fexample.com%2Fforbidden%20-sh%0Abypassfuzzer.py%20-u%20https%3A%2F%2Fexample.com%2Fforbidden%20–skip-headers%0A%0A%23%20Skip%20sending%20path%20normailization%20payloads%0Abypassfuzzer.py%20-u%20https%3A%2F%2Fexample.com%2Fforbidden%20-su%0Abypassfuzzer.py%20-u%20https%3A%2F%2Fexample.com%2Fforbidden%20–skip-urls”/]
Hide response code/length
Provide comma-delimited lists without spaces. Examples:
[pastacode lang=”markup” message=”” highlight=”” provider=”manual” manual=”%23%20Hide%20response%20codes%0Abypassfuzzer.py%20-u%20https%3A%2F%2Fexample.com%2Fforbidden%20-hc%20403%2C404%2C400%20%20%0A%0A%23%20Hide%20response%20lengths%20of%20638%0Abypassfuzzer.py%20-u%20https%3A%2F%2Fexample.com%2Fforbidden%20-hl%20638%20%20″/]
Source: https://github.com/intrudir/
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
