NoMore403

nomore403 is a command-line tool for testing HTTP access-control bypasses and parser inconsistencies around 401, 403, and related responses.

The tool is designed for practical web security work: bug bounty, penetration testing, security reviews, and regression testing of access-control rules. It automates a broad set of request mutations, captures a baseline, filters common false positives, and highlights the responses most likely to represent a meaningful bypass.

What It Does

Given a target URL, nomore403:

1. Sends a baseline request to capture the blocked response.
2. Optionally auto-calibrates against non-existent paths to learn the target's default error behavior.
3. Runs a set of bypass techniques that mutate the request path, method, headers, or wire format.
4. Scores and groups the results to reduce noise.
5. Emits replayable evidence, including curl commands for interesting findings.

This tool does not "break authentication" by itself. It helps find differences between how frontends, proxies, WAFs, CDNs, application routers, and backends interpret the same request.

Features

• Baseline-driven comparison against the blocked response
• Auto-calibration to reduce false positives from default 404 or parent-path responses
• Scored output with separate summaries for likely bypasses and interesting variations
• Replay and reproducibility for high-value findings
• Retry and backoff for transient network failures
• Concurrent execution with per-technique progress
• Raw HTTP support for request forms that net/http normalizes away
• JSON and JSONL output for pipelines and post-processing
• Input from a single URL, URL files, stdin, or request files

Installation

Build from source

git clone https://github.com/devploit/nomore403
cd nomore403
go build

Install with Go

go install github.com/devploit/nomore403@latest

If you install with go install, the payloads/ directory is not installed automatically. Clone the repository and point the tool to that directory with -f if needed.

Requirements

• Go 1.24 or later to build from source
• curl available in PATH for techniques that depend on it, such as:
  • http-versions
  • http-parser
  • absolute-uri

Most techniques work without curl.

Quick Start

Basic scan:

./nomore403 -u https://target.tld/admin

Use a proxy and verbose output:

./nomore403 -u https://target.tld/admin -x http://127.0.0.1:8080 -v

Run only selected techniques:

./nomore403 -u https://target.tld/admin -k headers,absolute-uri,raw-desync

Read targets from stdin:

cat urls.txt | ./nomore403

Use a Burp-style request file:

./nomore403 --request-file request.txt

Write machine-readable output:

./nomore403 -u https://target.tld/admin --jsonl -o findings.jsonl

Example Output

target: https://target.tld/admin   method: GET   frontend: AWS ELB/ALB   payloads: payloads

calib: 404 | 1245b | ±50 | frag 703b

BASELINE
  default       403    520 bytes    https://target.tld/admin

FINDINGS
  hdr-ip     100! 200   2048 bytes   X-Original-URL: /
  abs-uri     26. 403    236 bytes   request-target: https://target.tld/admin
  http        18. 400    122 bytes   HTTP/2

no visible results: 17 techniques

━━━━━━━━━━━━━━ LIKELY BYPASS ━━━━━━━━━━━━━━━━━
[!100 HIGH] Header injection (IP) 403=>200    2048b
         why: status 403->200, len Δ1528, body changed, type changed
        item: X-Original-URL: /
        curl: curl -i -sS -k -H 'User-Agent: nomore403' -H 'X-Original-URL: /' 'https://target.tld/admin'

How to Read the Output

Main technique output

Each visible line is a response that differed enough from the baseline to survive filtering.

Typical fields:

• technique alias, for example hdr-ip, abs-uri, or parser
• compact score marker such as 18., 61+, or 100!
• final response status
• response size
• item or payload used

Summary transitions

The final summaries show baseline-to-result transitions:

• 403=>200 usually deserves immediate attention
• 403=>302 can be interesting, but may still resolve back into an auth barrier
• 403->400 or 403->404 usually indicate parser or routing differences rather than a bypass

Summaries

At the end of the run, nomore403 prints:

• LIKELY BYPASS
  • highest-scoring results
  • includes reproducible curl
• INTERESTING VARIATIONS
  • meaningful parser or routing differences that are worth manual review
• no visible results
  • count of techniques that ran but produced no visible output after filtering

Scoring Model

Scoring is heuristic. It is intended to prioritize results, not to prove exploitation.

The tool generally rewards:

• transitions to 2xx
• transitions to 3xx
• large body-length changes
• body hash changes
• Location changes
• anomalous redirects that do not appear to resolve into a login or denied flow
• differences that survive replay

The tool generally down-ranks:

• near-identical responses
• repeated parser noise
• unstable replay results
• empty-body redirects that appear to lead back into access control
• many 400 and 404 cases unless the response also changes substantially

Recommended interpretation:

• HIGH: likely actionable; review first
• MED: plausible candidate; usually worth manual replay
• LOW: parser difference, routing anomaly, or lower-confidence behavior

Auto-Calibration

Auto-calibration is enabled by default in non-verbose mode.

It sends requests to several non-existent paths and builds a baseline for the target's default error behavior. It also performs a fragment-based calibration request to reduce false positives caused by fragment-stripped paths.

Use these flags to control it:

• --no-calibrate
  • compare only against the default blocked response
• --strict-calibrate
  • also compare body hash and key headers such as Location, Content-Type, and Server

Techniques

The tool runs all techniques by default unless you specify -k.

Method and verb mutations

• verbs
  • alternative HTTP methods from payloads/httpmethods
• verbs-case
  • randomized casing of HTTP methods
• method-override
  • query, header, and body-based method override patterns

Header- and trust-based mutations