sobri3195/pegasus---forbidden-busterA penetration testing tool for bypassing HTTP 401/403 responses using various header manipulation techniques and path fuzzing.
Author: Letda Kes dr. Sobri, S.Kom.
A penetration testing tool for bypassing HTTP 401/403 responses using various header manipulation techniques and path fuzzing.
# Clone the repository
git clone https://github.com/sobri3195/pegasus-forbidden-buster.git
cd pegasus-forbidden-buster
# Install requirements
pip install -r requirements.txt
Basic usage:
python pegasus_cli.py -u https://example.com/restricted-area
Advanced usage:
python pegasus_cli.py -u https://example.com/admin -m POST -H "Authorization: Basic YWRtaW46YWRtaW4=" -d '{"username":"admin"}' -p http://127.0.0.1:8080 --rate-limit 5 --include-all --threads 10 --output report.html --format html
| Option | Description |
|---|---|
-u, --url | Target URL to test (required) |
-m, --method | HTTP Method to use (default: GET) |
-H, --header | Add custom header (format: "Name: Value") |
-d, --data | Request body data (supports JSON string) |
-p, --proxy | Proxy to use (format: http://ip:port) |
--rate-limit | Rate limit in requests per second (default: 10) |
--threads | Number of threads for parallel scanning (default: 5) |
--include-unicode | Enable Unicode path fuzzing |
--include-user-agent | Enable User-Agent fuzzing |
--include-params | Enable parameter pollution attacks |
--include-cookies | Enable cookie manipulation techniques |
--include-all | Enable all bypass techniques |
--discover | Enable content discovery mode |
--wordlist | Path to wordlist file for content discovery |
--extensions | Comma-separated list of extensions to try |
--output | Output file to save results |
--format | Output format (json, html, text) |
-v, --verbose | Enable verbose output |
-q, --quiet | Suppress banner and non-essential output |
--timeout | Request timeout in seconds (default: 10) |
# Basic scan
python pegasus_cli.py -u https://example.com/admin
# Full scan with all techniques
python pegasus_cli.py -u https://example.com/admin --include-all
# Content discovery scan
python pegasus_cli.py -u https://example.com/admin --discover --wordlist wordlists/common.txt --extensions php,html,txt
# Generate HTML report
python pegasus_cli.py -u https://example.com/admin --include-all --output reports/report.html --format html
# Use custom headers and proxy
python pegasus_cli.py -u https://example.com/admin -H "X-Custom-Header: Value" -H "Authorization: Bearer token" -p http://127.0.0.1:8080
pegasus-forbidden-buster/
├── pegasus_cli.py # Main CLI entry point
├── requirements.txt # Dependencies
├── README.md # Documentation
├── src/
│ ├── core/ # Core scanner functionality
│ ├── modules/ # Bypass technique modules
│ ├── utils/ # Utility functions
│ └── data/ # Data files and payloads
├── reports/ # Generated reports
└── examples/ # Example configurations
Contributions are welcome! Please feel free to submit a Pull Request.
If you find this tool useful, consider supporting the development:
This tool is intended for legal penetration testing and security research purposes only. Usage against any systems without explicit permission is illegal and not the intended use case of this software.
This project is licensed under the MIT License - see the LICENSE file for details.
--user-agent| Custom User-Agent to use |
--cookies | Cookies to use (format: "name1=value1; name2=value2") |
--auth | HTTP Basic Authentication (format: "username:password") |
--depth | Path traversal depth (default: 3) |