spyboy-productions/websecprobeSecurity testing tool for analyzing HTTP 403 responses and identifying access control misconfigurations in web applications.
.png)
WebSecProbe is a security testing utility designed for web security researchers, penetration testers, and system administrators to analyze HTTP 403 (Forbidden) responses and access control behavior in web applications.
The tool assists in identifying misconfigurations, inconsistent authorization checks, and unintended access paths by systematically testing request variations, headers, and endpoints. These techniques help reveal weaknesses that could otherwise remain unnoticed during manual testing.
WebSecProbe is intended for authorized security assessments and defensive research, enabling teams to validate access control implementations and strengthen the overall security posture of their web applications.
[!IMPORTANT] This tool must be used only on applications you own or have explicit permission to test.
WebSecProbe is designed to perform a series of HTTP requests to a target URL with various payloads in order to test for potential security vulnerabilities or misconfigurations. Here's a brief overview of what the code does:
Does This Tool Bypass 403 ?
The code's purpose is more about testing the behaviour of the server when different requests are made, including requests with various payloads, headers, and URL variations. While some of the payloads and headers in the code might be used in certain scenarios to test for potential security misconfigurations or weaknesses, it doesn't guarantee that it will bypass a 403 Forbidden status code.
In summary, this code is a tool for exploring and analyzing a web server's responses to different requests, but whether or not it can bypass a 403 Forbidden status code depends on the specific configuration and security measures implemented by the target server.
Here's a brief breakdown of the payloads:
Empty String:
URL Encoding (%2e):
Path with Slash (/):
Double Slash (//):
Path with Current Directory (./):
Request Header (-H X-Original-URL):
Request Header (-H X-Custom-IP-Authorization):
Request Header (-H X-Forwarded-For):
Request Header (-H X-rewrite-url):
URL Encoding (%20 and %09):
Query Parameter (?):
Path with HTML Extension (.html):
Path with Query String (/?anything):
Fragment Identifier (#):
POST Request Header (-H Content-Length:0 -X POST):
Wildcard (*):
pip install WebSecProbe
WebSecProbe <URL> <Path>
Example:
WebSecProbe https://example.com admin-login
from WebSecProbe.main import WebSecProbe
if __name__ == "__main__":
url = 'https://example.com' # Replace with your target URL
path = 'admin-login' # Replace with your desired path
probe = WebSecProbe(url, path)
probe.run()
Contributions and feature requests are welcome! If you encounter any issues or have ideas for improvement, feel free to open an issue or submit a pull request.
Path with PHP Extension (.php):
Path with JSON Extension (.json):
HTTP Method (-X TRACE):
Request Header (-H X-Host):
Path Traversal (..;/):
Whitespace at the Beginning (" " + self.path):
Path with Semicolon (;):
Path with Extra Slashes:
Path with URL-encoded Slash:
Path with Double URL-encoded Slash:
Path with Path Parameter:
Path with Query Parameter in Path:
Path with Additional Dots:
Path with Unicode Encoding:
Path with Double URL-encoded Dot:
Path with URL-encoded Null Byte:
Path with Hex Encoding:
This list covers a variety of common techniques used in web security testing. However, the effectiveness of these payloads depends on the specific vulnerabilities or misconfigurations present in the target system.