403 Forbidden Bypass

Hey hunters! This writeup is related with my previous writeup. I’ll share with you how I was able to bypass 403 Forbidden. So, Let’s get start.

While hunting on private program I got 403 Forbidden on erp.redacted.com/plesk-stat.

403 Forbidden

I used directory listing dork. Not worked there. I did spider also via burp. Still I got that 403 Forbidden.🤔

I checked my template which I submitted to the nuclei and I got endpoints.

Time to bypass

I append that endpoints, and voila! I got 200 OK.😄

anon_ftpstat, ftpstat, webstat-ssl, webstat

200 OK

So decided to share it with dirsearch and I had contributed. And they added my endpoints in their list. This tool is now available in official Kali Linux packages.

You can also use this command while recon.

cat target | httpx -path /plesk-stat/webstat -status-code -title

Some references for bypass 403.

Bypass403, bypass4xx, DirDar

Check this tweet.

Thank you for Reading! 😊

Instagram: th3.d1p4k

Twitter: Dipak Panchal




Bug hunter | CCSE

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Why We Eat Our Own Dog Food, and You Should, too?

Eating your own dog food

Let your AI see in Unity

You should buy an ESP8266

Hacking the hackathon organizing team, part 2: The “team” part of team management

How Can You Document Your Systems So They Are Actually Used

How Do I Reactivate The “Undo” Function In Ms Word?

9 Best Strings Problem Solved Using C

David vs Goliath: How to Compete (and win) with Huge Software Development Companies

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store


Bug hunter | CCSE

More from Medium

Hacked Dutch Government Website. All I got was this l̶o̶u̶s̶y̶ cool T-Shirt.

The Password Bypass Leads to Full-Account-Takeover

IDOR vulnerability on invoice and weak password reset leads to account take over

2fa Bypass by changing Request method to DELETE