401/403 Bypass Techniques

A bypass candidate appears when two HTTP-processing layers (CDN, reverse proxy, web server, framework) decide differently about the same request. The useful signal is a change in routing or protected content, not a status code alone.

When to Use

• A known route returns 401 Unauthorized or 403 Forbidden.
• A reverse proxy, WAF, API gateway, or CDN sits in front of the application.
• Frontend and backend normalize paths, methods, or headers differently.
• IIS, Tomcat, Spring, Apache, Nginx, or WebDAV routing is visible.
• Equivalent requests return different status, headers, or body, hinting at a routing differential.

Prerequisites

• An HTTP client that preserves raw paths: curl --path-as-is or Burp Repeater.
• A denied baseline request plus a marker for the expected protected content.
• Optional tooling: byp4xx, dirsearch, feroxbuster, Burp Intruder, nghttp, nc.