Forbidden

Bypass 4xx HTTP response status codes and more.

The tool is based on Python Requests, PycURL, and HTTP Client.

Tested on Kali Linux v2024.2 (64-bit).

Made for educational purposes. I hope it will help!

Future plans:

Add the silent option to suppress console output.
Add the no color option to disable colored console output.
Add tests for hop-by-hop HTTP request headers.
Add tests for the User-Agent HTTP request header.
Add tests for HTTP cookies.
Add tests for HTTP smuggling.
Add tests for CRLF.
Add tests for Log4j.
Add tests for AWS metadata SSRF.

How to Install
How to Use
Tests
- HTTP Methods
- HTTP Request Headers
Results
Usage
Images

How to Install

Install PycURL

On Kali Linux, this should work without issues; otherwise, run:

apt-get -y install libcurl4-gnutls-dev librtmp-dev

pip3 install --upgrade pycurl

PycURL on Windows OS is not supported.

On macOS, run:

brew uninstall curl
brew uninstall openssl

brew install curl
brew install openssl

echo 'export PATH="/opt/homebrew/opt/curl/bin:$PATH"' >> ~/.zshrc
echo 'export PATH="/opt/homebrew/opt/openssl@3/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc

export LDFLAGS="-L/opt/homebrew/opt/curl/lib"
export CPPFLAGS="-I/opt/homebrew/opt/curl/include"
export PYCURL_SSL_LIBRARY=openssl

pip3 install --no-cache-dir --compile --ignore-installed --config-setting="--with-openssl=" --config-setting="--openssl-dir=/opt/homebrew/opt/openssl@3" pycurl

Alternatively, install using Homebrew (not maintained by me):

brew install forbidden

Standard Install

pip3 install --upgrade forbidden

Build and Install From the Source

git clone https://github.com/ivan-sincek/forbidden && cd forbidden

python3 -m pip install --upgrade build

python3 -m build

python3 -m pip install dist/forbidden-13.4-py3-none-any.whl

How to Use

Bypass 403 Forbidden HTTP response status code:

forbidden -u https://example.com/admin -t protocols,methods,uploads,overrides,headers,paths-ram,encodings -f GET -l initial,path -o forbidden_403_results.json

Bypass 403 Forbidden HTTP response status code with stress testing:

mkdir stresser_403_results

stresser -u https://example.com/admin -r 1000 -th 200 -f GET -l initial -dir stresser_403_results -o stresser_403_results.json

Bypass 401 Unauthorized HTTP response status code:

forbidden -u https://example.com/admin -t auths -f GET -l initial -o forbidden_401_results.json

Test for open redirects and broken URL parsers, i.e., test for out-of-band (OOB) interactions:

forbidden -u https://example.com/admin -t redirects,parsers -f GET -l initial -e xyz.interact.sh -o forbidden_oob_results.json

Tests

protocols

Test HTTP and HTTPS protocols using an IP address and domain name.
Test an HTTP/1.0 protocol downgrade without the Host HTTP request header, using an IP address and domain name.

methods

Test the allowed HTTP methods, also using the Content-Length: 0 HTTP request header.
Test Cross-Site Tracing (XST) using the HTTP TRACE and TRACK methods.

uploads

Test a text file upload recursively for each directory in the URL path using the HTTP PUT method.

overrides

Test HTTP method overrides using URL query string parameters, HTTP request headers, and HTTP request bodies.
Test URL scheme overrides using HTTP request headers, from HTTPS to HTTP and from HTTP to HTTPS.
Test port overrides using HTTP request headers.
Test HTTP host overrides using HTTP request headers, also using two Host HTTP request headers.
Test URL path overrides using HTTP request headers with relative URL paths, using the following URLs: an accessible URL, root URL, and full URL.

headers

Test HTTP request headers with IP addresses, comma-separated IP addresses, domain names, root URLs, full URLs, and more.

values

Test HTTP request headers with user-supplied IP addresses, domain names, root URLs, and full URLs.

paths

Test URL path bypasses.

encodings

Test URL host and path transformations and encodings.

auths

Test basic authentication/authorization using HTTP request headers with null values and predefined Base64 encoded credentials.
Test bearer authentication/authorization using HTTP request headers with null values, malformed JWTs, and predefined JWTs.

redirects

Test open redirects using HTTP request headers with redirect IP addresses, domain names, root URLs, and full URLs.

parsers

Test broken URL parsers using HTTP request headers with broken IP addresses, domain names, root URLs, and full URLs.

If you're interested in more details, see:

Remarks:

All the tests are based on public infosec and bug bounty write-ups.
Some of the tests overlap; however, a unique filter is applied before anything is sent.
All the HTTP request headers, URL query string parameters, etc., were validated based on official documentation.
By default, both Forbidden and Stresser use the Python Requests engine.
Testing the HTTP/1.0 protocol downgrade without the Host HTTP request header is locked to the HTTP Client engine. Additionally, the provided cURL command will not work properly because cURL does not allow removing the Host HTTP request header.
Testing the HTTP host override using two Host HTTP request headers is locked to the Python Requests engine. Additionally, the provided cURL command will not work properly because cURL does not allow using two Host HTTP request headers.
Testing URL host and path transformations and encodings is locked to the PycURL engine.
Some web proxies might normalize URLs (e.g., when testing encodings), modify HTTP requests, or drop HTTP requests entirely.
Some websites might require a valid or very specific User-Agent HTTP request header.
Cross-Site Tracing (XST) is no longer considered a vulnerability.
Beware of rate limiting and other similar anti-bot protections; take some time before running the tool again on the same domain.

HTTP Methods

This is just a quick overview of what is used, but not how it is used.

ACL
ARBITRARY
BASELINE-CONTROL
BIND
CHECKIN
CHECKOUT
CONNECT
COPY
DELETE
GET
HEAD
INDEX
LABEL
LINK
LOCK
MERGE
MKACTIVITY
MKCALENDAR
MKCOL
MKREDIRECTREF
MKWORKSPACE
MOVE
OPTIONS
ORDERPATCH
PATCH
POST
PRI
PROPFIND
PROPPATCH
PUT
REBIND
REPORT
SEARCH
SHOWMETHOD
SPACEJUMP
TEXTSEARCH
TRACE
TRACK
UNBIND
UNCHECKOUT
UNLINK
UNLOCK
UPDATE
UPDATEREDIRECTREF
VERSION-CONTROL

HTTP Request Headers