403-Killchain

Four native bypass engines. One binary. Zero dependencies.
Turns 403 Forbidden into 200 OK — and tells you exactly which request did it.

How it works · Install · Usage · Engines · Detection methodology

---

Why

Most 403-bypass tooling is a pile of shell scripts glued together: you run four tools, diff four outputs by eye, and hope you spot the one request that mattered.

403-Killchain is a single, self-contained Go binary that runs four independent bypass engines in parallel, fingerprints the server's denial response first, and classifies every result against that fingerprint — so a 200 OK that actually serves the same "403 Forbidden" page never fools it.

Every finding ships with a copy-pasteable curl --path-as-is reproduction command for your report.

How it works

            ┌──────────────────────────────────────────────┐
            │                TARGET  /admin                │
            └──────────────────┬───────────────────────────┘
                               │
                    baseline fingerprint
              (status · body length · content shingles)
                               │
        ┌──────────────┬───────┴──────┬─────────────────┐
        ▼              ▼              ▼                 ▼
   ┌─────────┐   ┌──────────┐   ┌──────────┐    ┌───────────┐
   │  path   │   │ headers  │   │ methods  │    │ encoding  │
   │ engine  │   │  engine  │   │  engine  │    │  engine   │
   └────┬────┘   └────┬─────┘   └────┬─────┘    └─────┬─────┘
        └──────────────┴───────┬──────┴────────────────┘
                               ▼
                   classify vs. baseline
          (CONFIRMED / SUSPECTED / BLOCKED + reason)
                               │
                     report · curl repros
                  (terminal · JSON · markdown)

Installation

From source (Go 1.24+):

go install github.com/Archsec-Emman/403-Killchain@latest

Docker:

docker build -t 403-killchain .
docker run --rm 403-killchain -u https://target.example/admin

Prebuilt binaries for Linux/macOS/Windows (amd64/arm64) are attached to each release.

Usage

403-killchain -u https://target.example/admin

403-killchain -u https://target.example/admin \
  --engines path,encoding \
  -c 20 \
  --proxy http://127.0.0.1:8080 \
  --json report.json \
  --markdown report.md \
  -v

Flag	Default	Description
-u	—	Target URL including protected path (required)
--engines	all	Comma-separated: path, headers, methods, encoding
-c	10	Concurrent requests
--timeout	10s	Per-request timeout
--rps	unlimited	Rate limit (requests/second)
--proxy	—	HTTP(S)/SOCKS proxy (Burp-friendly)
--insecure	off	Skip TLS verification
--header	—	Extra header KEY:VALUE, repeatable
--json / --markdown	—	Write machine-readable reports
-v	off	Also show blocked attempts

Exit codes: 0 no bypass found · 1 confirmed bypass(es) found · 2 operational error. The 1 exit code makes the tool scriptable — fail CI on authorization regressions, chain into other automation.

Engines

All four engines are implemented natively in this repository. No third-party binaries are embedded, wrapped, or executed.

Engine	Technique class	Examples
path	Structural path manipulation	trailing slash /admin/, dot-segments /./, semicolon path params /.;/, glob /*, case toggling
headers	Reverse-proxy / CDN trust abuse	X-Original-URL, X-Rewrite-IP family, loopback spoofing via X-Forwarded-For & friends, host override headers
methods	HTTP method confusion	POST/PUT/PATCH/DELETE/HEAD/OPTIONS/TRACE, X-HTTP-Method-Override
encoding	Parser differential exploitation	single/double percent-encoding (%2f, %252f), overlong UTF-8 (%c0%af), fullwidth solidus, backslash separators, null bytes

Detection methodology

Naive tools celebrate any non-403 status. That's wrong in two directions:

1. False positives: many WAFs return 200 with the same denial page.
2. Missed hits: some servers leak the resource only under HEAD, or redirect into the protected area.

403-Killchain fingerprints the baseline denial (status, length, character-shingle set of the body) and then classifies every probe:

Verdict	Meaning
CONFIRMED	2xx with content statistically distinct from the denial page
SUSPECTED	2xx but body ≈ denial page, unverifiable HEAD, empty body, or suspicious redirect — verify manually with the provided repro command
BLOCKED	Still denied, errored, or rate-limited

Example output

Target:    https://target.example/admin
Baseline:  HTTP 403 (512 bytes)
Probes:    74 (encoding, headers, methods, path)

CONFIRMED (2)
  [200] GET /admin/.;/
      path · 200 with distinct content (4% similarity to denial page) · 4,891 bytes
      repro: curl --path-as-is -s -o /dev/null -W "%{http_code}" "https://target.example/admin/.;/"

SUSPECTED (1)
  [200] HEAD /admin/
      methods · 200 on HEAD (body not verifiable), re-verify with GET · 0 bytes
      repro: curl --path-as-is -s -o /dev/null -W "%{http_code}" -X HEAD "https://target.example/admin/"

Development

go build ./...     # compile
go test ./...      # unit + end-to-end tests (simulated vulnerable/hardened servers)
go vet ./...

The e2e suite spins up deliberately vulnerable and hardened HTTP servers and asserts the engine finds real bypasses on the former and none on the latter.

Roadmap

• Wordlist mode (-w paths.txt) for bulk path testing
• Per-engine timing/metrics output
• Optional fuzzing engine (header value mutations)
• SARIF output for CI integrations

License

MIT — see LICENSE. This project has zero third-party runtime dependencies.

Disclaimer

For authorized security testing only: your own systems, engagements with written permission, or bug-bounty programs within scope. Unauthorized access to computer systems is illegal.