Web Checklists on nix4cyber

403 Forbidden Bypass

Mon, 01 Jan 0001 00:00:00 +0000

A 403 Forbidden bypass refers to techniques used to circumvent HTTP access control restrictions and gain unauthorized access to protected web resources. These methods exploit server misconfigurations through header manipulation, path obfuscation, URL encoding, and cache poisoning to access restricted endpoints that normally return a 403 status code.

IDOR

Mon, 01 Jan 0001 00:00:00 +0000

IDOR (Insecure Direct Object Reference)

IDOR is an access control vulnerability where an application uses a direct identifier (like an account number or user ID) without properly verifying if the requesting user is authorized to access it.

Open-Redirects

Mon, 01 Jan 0001 00:00:00 +0000

How to find entry points to test?

Caido HTTP history (look at URLs with parameters)

Google dorking

site:target.com inurl:(go= OR return= OR r_url= OR returnUrl= OR returnUri= OR locationUrl= OR goTo= OR return_url= OR next= OR continue= OR checkout_url= OR dest= OR destination= OR image_url= OR redirect= OR redir= OR return_path= OR return_to= OR rurl= OR target= OR view=)

Functionalities usually associated with redirects: