nomore403 - 🚫 Advanced tool for security researchers to bypass

项目说明

<p align="center">
<img src=" width="350" height="200" alt="NoMore403 logo">
</p>

<h1 align="center">NoMore403</h1>

<p align="center">
<a href=" alt="GitHub stars" src="
<a href=" alt="GitHub forks" src="
<a href=" alt="Go Report Card" src="
<img alt="Go " src="
<img alt="License: MIT" src="
<img alt="Contributions welcome" src="
</p>

nomore403 is a command-line 工具 for testing HTTP access-control bypasses and parser inconsistencies around 401, 403, and related responses.

The 工具 is designed for practical web security work: bug bounty, penetration testing, security reviews, and regression testing of access-control rules. It automates a broad set of request mutations, captures a baseline, filters common false positives, and highlights the responses most likely to represent a meaningful bypass.

What It Does

Given a target URL, nomore403:

1. Sends a baseline request to capture the blocked response.
2. Optionally auto-calibrates against non-existent paths to learn the target's default error behavior.
3. Runs a set of bypass techniques that mutate the request path, method, headers, or wire format.
4. Scores and groups the results to reduce noise.
5. Emits replayable e, including curl commands for interesting findings.

This 工具 does not "break authentication" by itself. It helps find differences between how frontends, proxies, WAFs, CDNs, application routers, and backends interpret the same request.

Features

Baseline-dri against the blocked response

Auto-calibration to reduce false positives from default 404 or parent-path responses

Scored output with separate summaries for likely bypasses and interesting

Replay and reproducibility for high-value findings

Retry and backoff for transient 网络 failures

Concurrent execution with per-technique progress

Raw HTTP support for request forms that net/http normalizes away

JSON and JSONL output for pipelines and post-processing

Input from a single URL, URL files, stdin, or request files

Installation

Build from source

Install with Go

If you install with go install, the payloads/ directory is not installed automatically. Clone the repository and point the 工具 to that directory with -f if needed.

Requirements

Go 1.24 or later to build from source

curl a in PATH for techniques that depend on it, such as:

- http-
- http-parser
- absolute-uri

Most techniques work without curl.

Quick Start

Basic scan:

Use a proxy and output:

Run only selected techniques:

Read targets from stdin:

Use a Burp-style request file:

Write machine-readable output:

Example Output

How to Read the Output

Main technique output

Each line is a response that differed enough from the baseline to survi.

Typical fields:

technique alias, for example hdr-ip, abs-uri, or parser

compact score marker such as 18., 61+, or 100!

final response status

response size

item or payload used

Summary transitions

The final summaries show baseline-to-result transitions:

403=>200 usually deser attention

403=>302 can be interesting, but may still resolve back into an auth barrier

403->400 or 403->404 usually indicate parser or routing differences rather than a bypass

Summaries

At the end of the run, nomore403 prints:

LIKELY BYPASS

- highest-scoring results
- includes reproducible curl

INTERESTING

- meaningful parser or routing differences that are worth manual review

no results

- count of techniques that ran but produced no output after filtering

Scoring Model

Scoring is heuristic. It is intended to prioritize results, not to pro.

The tool generally rewards:

transitions to 2xx

transitions to 3xx

large body-length changes

body hash changes

Location changes

anomalous redirects that do not appear to resolve into a login or denied flow

differences that survi

The tool generally down-ranks:

near-identical responses

repeated parser noise

unstable replay results

empty-body redirects that appear to lead back into access control

many 400 and 404 cases unless the response also changes substantially

Recommended interpretation:

HIGH: likely actionable; review first

MED: plausible candidate; usually worth manual replay

LOW: parser difference, routing anomaly, or lower-confidence behavior

Auto-Calibration

Auto-calibration is enabled by default in non- mode.

It sends requests to several non-existent paths and builds a baseline for the target's default error behavior. It also performs a fragment-based calibration request to reduce false positi by fragment-stripped paths.

Use these flags to control it:

--no-calibrate

- compare only against the default blocked response

--strict-calibrate

- also compare body hash and key headers such as Location, Content-Type, and Server

Techniques

The 工具 runs all techniques by default unless you specify -k.

Method and verb mutations

verbs

- alternative HTTP methods from payloads/httpmethods

- randomized casing of HTTP methods

method-o

- query, header, and body-based method o patterns

Header- and trust-based mutations

headers

- umbrella technique co:
- IP trust headers
- simple headers
- Host

hop-by-hop

- hop-by-hop stripping tricks using Connection

header-confusion

- rewrite and path-o headers such as X-Original-URL

host-o

- host o and forwarded-host

forwarded-trust

- Forwarded, Client-IP, Cluster-Client-IP, and related trust chains

proto-confusion

- X-Forwarded-Proto, X-Forwarded-Port, and related scheme hints

ip-encoding

- localhost and trusted-address in dotted, integer, hex, and IPv6 forms

Path and normalization mutations

endpaths

- suffix and end-of-path mutations from payloads/endpaths

midpaths

- path insertion and tra mutations from payloads/midpaths

double-encoding

- encoded path , including aggressi forms

unicode

- %uXXXX and o UTF-8 path

path-case

- path segment case switching

path-normalization

- dot-segment and semicolon normalization

suffix-tricks

- suffix and extension tricks such as .json, .css, ;index.html, and format-style query toggles

payload-position

- inserts payloads at explicitly marked positions in the URL

Frontend and wire-format mutations

http-

- compares the same request across HTTP/1.0 and HTTP/2

http-parser

- sends a deliberately minimal curl request to expose 客户端/frontend parser differences separately from http-

absolute-uri

- uses absolute-form request targets through curl --request-target

raw-duplicates

- duplicate security-relevant headers with raw HTTP

raw-authority

- duplicate or conflicting authority and host signals

raw-desync

- request forms aimed at frontend/backend parsing differences, including conflicting transfer semantics

Raw HTTP Behavior

Some techniques need wire-le that Go's net/http 客户端 does not provide. Those techniques use the raw HTTP 引擎.

Raw techniques currently include:

raw-duplicates

raw-authority

raw-desync

some %uXXXX unicode path requests

Notes:

raw requests are sent automatically where needed

raw techniques do not currently support upstream proxies

raw behavior is useful for:

- duplicate headers
- exact request targets
- transfer-encoding and content-length edge cases

Fingerprinting and Technique Order

The 工具 may infer frontend hints such as:

AWS ELB / ALB

CloudFront

Cloudflare

Nginx

Envoy

Apache

IIS

These hints are used to impro ordering and output context.

Important:

fingerprinting does not disable techniques by default

unless you use -k, the 工具 still runs the full default technique set

Reproducibility and Replay

High-value results are replayed automatically in the final summary.

The replay output helps answer:

did the behavior repeat?

did it keep the same status and response shape?

is this likely stable enough to in or report?

The final summary includes:

replay counts such as 1/1 or 2/2 matched on replay

a replayable curl command for interesting results

Input Modes

Single target

File containing URLs

Stdin

Request file

Request files are useful when replaying traffic captured in Burp or another proxy.

Custom Payload Positions

Use --payload-position when you want to inject payloads at explicit markers instead of relying only on built-in endpath and midpath mutation logic.

Example:

Common Workflows

Fast triage

In with an intercepting proxy

Run only raw and frontend-focused techniques

Test a custom trusted IP

Sa for later analysis

Flags

Run ./nomore403 --help for the full up-to-date CLI.

Key flags:

-u, --uri

- target URL, file of URLs, or input path

-k, --technique

- comma-separated list of techniques to run

-x, --proxy

- upstream proxy

-H, --header

- add custom headers

-i, --bypass-ip

- IP or hostname used in trust-header techniques

-

- show all results, not just filtered output

--json

- write structured JSON

--jsonl

- write one JSON object per result

--no-calibrate

- disable auto-calibration

--strict-calibrate

- compare more response fields during filtering

--retry-count

- number of retries for transient errors

--retry-backoff-ms

- exponential backoff base in milliseconds

--host-delay

- delay between batched targets on the same host

--top-score-min

- minimum score for LIKELY BYPASS

--

- minimum score for INTERESTING

--top

- maximum number of entries per summary section, or 0 to disable summaries

Output Formats

Human-readable terminal output

Default mode is optimized for interacti and triage.

JSON

Use --json for a single structured document.

JSON Lines

Use --jsonl when you want to:

process results incrementally

store e in pipelines

import findings into your own tooling

Payload Files

The payloads/ directory contains lists used by several techniques.

Current files include:

httpmethods

headers

ips

simpleheaders

endpaths

midpaths

useragents

You can customize these files to fit your targets or workflow.

Limitations

raw HTTP techniques do not currently support upstream proxies

scoring is heuristic and can produce false positives or false negatives

redirect scoring currently uses heuristics on the immediate redirect response, not a fully followed redirect chain

some techniques depend on target-specific behavior and may appear noisy on heavily normalized stacks

curl-based techniques require curl in PATH

Security and Responsible Use

Use this 工具 only on systems you are authorized to test.

The authors and contributors are not responsible for misuse. You are responsible for complying with applicable law, program rules, and organizational policy.

Contributing

Contributions are welcome.

Useful contribution areas include:

bug fixes

better payloads

new bypass techniques

raw HTTP impro

frontend fingerprinting

documentation and examples

Before contributing a technique, prefer:

a clearly distinct parsing or trust-boundary behavior

reproducible e

tests that the request shape or replay behavior

License

This project is released under the MIT License. See LICENSE.

项目信息

开发语言：Go

Star 数：1890

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕🚫 Advanced 工具 for security researchers to bypass 403/40X restrictions through smart techniques and adaptive request manipulation. Fast. Precise. Effective.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。