1c:I[73356,["10933","static/chunks/10933-713dc1c0b1561380.js","94937","static/chunks/94937-3f819e5ef7dfa8a0.js","9131","static/chunks/9131-9372417797d59026.js","98244","static/chunks/98244-037342d518451489.js","6342","static/chunks/6342-5661a6a2702af160.js","27689","static/chunks/27689-8d5be78f17754629.js","34877","static/chunks/app/(marketing)/blog/%5Bslug%5D/page-ee27fea45c92c1b5.js"],"BlogArticleEnhancements"] 1d:I[53721,["10933","static/chunks/10933-713dc1c0b1561380.js","94937","static/chunks/94937-3f819e5ef7dfa8a0.js","9131","static/chunks/9131-9372417797d59026.js","98244","static/chunks/98244-037342d518451489.js","6342","static/chunks/6342-5661a6a2702af160.js","27689","static/chunks/27689-8d5be78f17754629.js","34877","static/chunks/app/(marketing)/blog/%5Bslug%5D/page-ee27fea45c92c1b5.js"],"BlogViewTracker"] 1f:I[97042,["10933","static/chunks/10933-713dc1c0b1561380.js","94937","static/chunks/94937-3f819e5ef7dfa8a0.js","9131","static/chunks/9131-9372417797d59026.js","98244","static/chunks/98244-037342d518451489.js","6342","static/chunks/6342-5661a6a2702af160.js","27689","static/chunks/27689-8d5be78f17754629.js","34877","static/chunks/app/(marketing)/blog/%5Bslug%5D/page-ee27fea45c92c1b5.js"],"BlogToc"] 24:I[54324,[],"IconMark"] :HL["https://codelivly.com/wp-content/uploads/2023/02/403.jpg","image"] 20:T1ee0,

Today we’ll look at one of the external penetration tests that I carried out earlier this year. Due to the confidentiality agreement, we will use the usual domain of REDACTED.COM

So, to provide a bit of context to the test, it is completely black box with zero information being provided from the customer. The only thing we know is that we are allowed to test redacted.com and the subdomain my.redacted.com

I’ll skip through the whole passive information gathering process and will get straight to the point.

I start actively scanning and navigating through the website to discover potential entry points. There are no ports open other than 80 & 443.

So, I start directory bruteforcing with gobuster and straightaway, I see an admin panel that returns a 403 — Forbidden response.

Seeing this, we navigate to the website to verify that it is indeed a 403 and to capture the request with Burp Suite for potential bypasses.

In my mind, I am thinking that it will be impossible to bypass this, because there is an ACL for internal IP addresses. Nevertheless, I tried the following to bypass the 403:

HTTP Methods fuzzing (GET, POST, TRACE, HEAD etc.)
HTTP Headers fuzzing (X-Originating-IP: 127.0.0.1, X-Forwarded-For: 127.0.0.1 etc.)
Path fuzzing/force browsing (https://redacted.com/admin/index.html, https://redacted.com/admin/./index.html and more)
Protocol version changing (From HTTP 1.2, downgrade to HTTP 1.1 etc.)
String terminators (%00, 0x00, //, ;, %, !, ?, [] etc.) — adding those to the end of the path and inside the path

Long story short, none of those methods worked. So, I remember that sometimes the security controls are built around the literal spelling and case of components within a request. Therefore, I tried the ‘Case Switching’ technique — probably sounds dumb, but it actually worked!

To sum it up:

https://redacted.com/admin -> 403 Forbidden
https://redacted.com/Admin -> 200 OK
https://redacted.com/aDmin -> 200 OK

Swiching any of the letters to a capital one, will bypass the restriction.

Voila! We get a login page to the admin panel.

We get lucky with this one, nevertheless, we are now able to try different attacks (password spraying, brute forcing etc.). The company that we are testing isn’t small and we had collected quite a large number of employee credentials from leaked databases (leak check, leak peek and others). However, this is the admin panel and therefore we go with the usual tests:

See if there is username enumeration
See if there are any login restrictions
Check for possible WAF that will block us due to number of requests

To keep it short, there is neither. We are unable to enumerate usernames, however there is no rate limiting of any sort.

Considering the above, we load rockyou.txt and start brute forcing the password of the ‘admin’ account. After a few thousand attempts, we see the below:

We found valid credentials for the admin account. Navigate to the website’s admin panel, authenticate and we are in!

Now that we are in, there isn’t much more that we need to do or can do (without the consent of the customer). The admin panel with administrative privileges allows you to change the whole configuration — control the users & their attributes, control the website’s pages, control everything really. So, I decided to write a Python script that scrapes the whole database of users (around 39,300 — thirty nine thousand and three hundred) that contains their names, emails, phones & addresses. The idea to collect all those details is to then present them to the client (victim) — to show the seriousness of the exploited vulnerabilities. Also, due to the severity of those security weaknesses, we wrote a report the same day for those specific issues, which were fixed within 24 hours.

Ultimately, there wasn’t anything too difficult in the whole exploitation process, however the unusual 403 bypass is really something that I see for the first time and I thought that some of you might weaponize this or add it to your future 403 bypass checklists.

9:[["$","$L1c",null,{}],["$","$L1d",null,{"slug":"unusual-403-bypass-to-a-full-website-takeover-external-pentest"}],"$L1e",["$","div",null,{"className":"mx-auto max-w-6xl px-4 py-10 sm:px-6 sm:py-12","children":["$","div",null,{"className":"lg:grid lg:grid-cols-[minmax(0,1fr)_320px] lg:gap-10 xl:gap-12","children":[["$","article",null,{"id":"blog-content","className":"blog-content min-w-0 max-w-3xl","children":[["$","nav",null,{"className":"font-mono mb-6 text-xs text-[var(--hm-muted)]","children":[["$","$L1a",null,{"href":"/","className":"text-[var(--hm-muted)] no-underline hover:text-[var(--hm-mint)]","children":"Home"}],["$","span",null,{"className":"mx-2","children":"/"}],["$","$L1a",null,{"href":"/blog","className":"text-[var(--hm-muted)] no-underline hover:text-[var(--hm-mint)]","children":"Blog"}],["$","span",null,{"className":"mx-2","children":"/"}],["$","span",null,{"className":"text-[var(--hm-text)]","children":"Unusual 403 Bypass to a full website takeover [External Pentest]"}]]}],["$","header",null,{"className":"mb-8","children":[["$","div",null,{"className":"mb-6 overflow-hidden rounded-[2px] border border-[var(--hm-border)]","children":["$","img",null,{"src":"https://codelivly.com/wp-content/uploads/2023/02/403.jpg","alt":"Unusual 403 Bypass to a full website takeover [External Pentest]","className":"aspect-[16/9] w-full object-cover"}]}],["$","div",null,{"className":"mb-4 flex flex-wrap gap-2","children":[["$","span",null,{"className":"font-mono rounded-[2px] border border-[var(--hm-mint)]/30 bg-[var(--hm-mint)]/10 px-2.5 py-1 text-[11px] uppercase tracking-wider text-[var(--hm-mint)]","children":"Penetration Testing"}],[]]}],["$","h1",null,{"className":"font-display text-3xl font-bold leading-tight tracking-[-0.01em] text-[var(--hm-text-strong)] sm:text-[2.5rem]","children":"Unusual 403 Bypass to a full website takeover [External Pentest]"}],["$","p",null,{"className":"mt-4 text-base leading-relaxed text-[var(--hm-muted)]","children":"Today we’ll look at one of the external penetration tests that I carried out earlier this year. Due to the confidentiality agreement, we will use the usual domain of REDACTED.COM So, to provide a bit "}],["$","div",null,{"className":"mt-5 flex flex-wrap items-center gap-x-3 gap-y-2 border-t border-[var(--hm-border)] pt-5 font-mono text-xs text-[var(--hm-muted)]","children":[["$","span",null,{"className":"flex items-center gap-2","children":[["$","span",null,{"aria-hidden":true,"className":"flex h-7 w-7 items-center justify-center rounded-full border border-[var(--hm-ring)] bg-[rgba(0,230,118,0.08)] text-[11px] font-bold text-[var(--hm-mint)]","children":"R"}],["$","span",null,{"className":"text-[var(--hm-text)]","children":"rocky"}]]}],["$","span",null,{"aria-hidden":true,"children":"·"}],["$","time",null,{"dateTime":"2023-02-19T13:18:52.000Z","children":"Feb 19, 2023"}],[["$","span",null,{"aria-hidden":true,"children":"·"}],["$","span",null,{"children":[4," min read"]}]]]}]]}],["$","$L1f",null,{"items":[]}],["$","div",null,{"className":"blog-prose text-base leading-relaxed text-[var(--hm-text)]","children":["$","div",null,{"dangerouslySetInnerHTML":{"__html":"$20"}}]}],false,"$L21","$L22"]}],"$L23"]}]}]] c:null 11:[["$","title","0",{"children":"Unusual 403 Bypass to a full website takeover [External…"}],["$","meta","1",{"name":"description","content":"Today we’ll look at one of the external penetration tests that I carried out earlier this year. Due to the confidentiality agreement, we will use the usual…"}],["$","meta","2",{"name":"author","content":"Codelivly Team"}],["$","meta","3",{"name":"creator","content":"Codelivly"}],["$","meta","4",{"name":"publisher","content":"Codelivly"}],["$","meta","5",{"name":"robots","content":"index, follow"}],["$","link","6",{"rel":"canonical","href":"https://codelivly.com/unusual-403-bypass-to-a-full-website-takeover-external-pentest"}],["$","link","7",{"rel":"alternate","hrefLang":"en-US","href":"https://codelivly.com/unusual-403-bypass-to-a-full-website-takeover-external-pentest"}],["$","meta","8",{"property":"og:title","content":"Unusual 403 Bypass to a full website takeover [External…"}],["$","meta","9",{"property":"og:description","content":"Today we’ll look at one of the external penetration tests that I carried out earlier this year. Due to the confidentiality agreement, we will use the usual…"}],["$","meta","10",{"property":"og:url","content":"https://codelivly.com/unusual-403-bypass-to-a-full-website-takeover-external-pentest"}],["$","meta","11",{"property":"og:site_name","content":"Codelivly"}],["$","meta","12",{"property":"og:locale","content":"en_US"}],["$","meta","13",{"property":"og:image","content":"https://codelivly.com/wp-content/uploads/2023/02/403.jpg"}],["$","meta","14",{"property":"og:image:width","content":"1200"}],["$","meta","15",{"property":"og:image:height","content":"630"}],["$","meta","16",{"property":"og:type","content":"article"}],["$","meta","17",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","18",{"name":"twitter:creator","content":"@codelivly"}],["$","meta","19",{"name":"twitter:title","content":"Unusual 403 Bypass to a full website takeover [External…"}],["$","meta","20",{"name":"twitter:description","content":"Today we’ll look at one of the external penetration tests that I carried out earlier this year. Due to the confidentiality agreement, we will use the usual…"}],["$","meta","21",{"name":"twitter:image","content":"https://codelivly.com/wp-content/uploads/2023/02/403.jpg"}],["$","link","22",{"rel":"shortcut icon","href":"/favicon.svg"}],["$","link","23",{"rel":"icon","href":"/favicon.svg"}],["$","link","24",{"rel":"apple-touch-icon","href":"/favicon.svg"}],["$","$L24","25",{}]]