U.S. Dept Of Defense · Report #991717
403 Forbidden Bypass at www.██████.mil
Summary
403 Page Bypass possible with misconfigured server. Attacker can read pages cause of misconfigured server.
How it was found
Hi team, I managed to bypass 403 forbidden pages in www.████████.mil #Reproduce
- Click https://www.████████.mil/███████ (Example Forbidden page). If you click you will redirect to 403 "forbidden" page.
- But you can bypass this.
- type this command:
curl -H "Content-Length:0" -X POST https://www.████████.mil/███
#Proof-of-Concept
For exploit write this command.
Exploited command: curl -H "Content-Length:0" -X POST https://www.███████.mil/██████████
Denied command: curl -X GET https://www.███████.mil/██████
#Questions:
Why you need "Content-Length:0" header?
Answer: If you dont use this headersometimes you can get 411 error code.
Can i reproduce this in burpsuite?
Answer: Yes, you can.But "curl" faster.
How you did bypass?
**Answer:**With POST method and Content-Length header.If you send GET or dont use that header you cant bypass.
#Note I looked for something important in the site. However, I could not find it. But if something important is used within the site and maintained in the same way, it may be possible to bypass it with the same techniques.
Impact
Attacker can bypass forbidden 403 pages.