NoMore403

Introduction

nomore403 is an innovative tool designed to help cybersecurity professionals and enthusiasts bypass HTTP 40X errors encountered during web security assessments. Unlike other solutions, nomore403 automates various techniques to seamlessly navigate past these access restrictions, offering a broad range of strategies from header manipulation to method tampering.

Prerequisites

Before you install and run nomore403, make sure you have the following:

• Go 1.15 or higher installed on your machine.

Installation

From Releases

Grab the latest release for your OS from our Releases page.

Compile from Source

If you prefer to compile the tool yourself:

git clone https://github.com/devploit/nomore403
cd nomore403
go get
go build

Customization

To edit or add new bypasses, modify the payloads directly in the payloads folder. nomore403 will automatically incorporate these changes.

Usage

Output example

━━━━━━━━━━━━━━ NOMORE403 CONFIGURATION ━━━━━━━━━━━━━━━━━━
Target:                 https://domain.com/admin
Headers:                false
Proxy:                  false
User Agent:             nomore403
Method:                 GET
Payloads folder:        payloads
Custom bypass IP:       false
Follow Redirects:       false
Rate Limit detection:   false
Status:                 
Timeout (ms):           6000
Delay (ms):             0
Techniques:             verbs, verbs-case, headers, endpaths, midpaths, double-encoding, http-versions, path-case
Unique:                 false
Verbose:                false

━━━━━━━━━━━━━━━ AUTO-CALIBRATION RESULTS ━━━━━━━━━━━━━━━
[✔] Calibration URI: https://domain.com/admin/calibration_test_123456
[✔] Status Code: 404
[✔] Content Length: 1821 bytes

━━━━━━━━━━━━━ DEFAULT REQUEST ━━━━━━━━━━━━━
403 	  429 bytes https://domain.com/admin

━━━━━━━━━━━━━ VERB TAMPERING ━━━━━━━━━━━━━━

━━━━━ VERB TAMPERING CASE SWITCHING ━━━━━━━

━━━━━━━━━━━━━ HEADERS ━━━━━━━━━━━━━━━━━━━━━

━━━━━━━━━━━━━ CUSTOM PATHS ━━━━━━━━━━━━━━━━
200 	 2047 bytes https://domain.com/;///..admin

━━━━━━━━━━━━━ DOUBLE-ENCODING ━━━━━━━━━━━━━

━━━━━━━━━━━━━ HTTP VERSIONS ━━━━━━━━━━━━━━━
403      429 bytes HTTP/1.0

━━━━━━━━━━ PATH CASE SWITCHING ━━━━━━━━━━━━
200 	 2047 bytes https://domain.com/%61dmin

Basic Usage

./nomore403 -u https://domain.com/admin

Verbose Mode + Proxy + Specific techniques to use

./nomore403 -u https://domain.com/admin -x http://127.0.0.1:8080 -k headers,http-versions -v

Parse request from Burp

./nomore403 --request-file request.txt

Use custom header + specific IP address for bypasses

./nomore403 -u https://domain.com/admin -H "Environment: Staging" -b 8.8.8.8

Set new max of goroutines + add delay between requests

./nomore403 -u https://domain.com/admin -m 10 -d 200

Options

./nomore403 -h
Command line application that automates different ways to bypass 40X codes.

Usage:
  nomore403 [flags]

Flags:
  -i, --bypass-ip string      Use a specified IP address or hostname for bypassing access controls. Injects this IP in headers like 'X-Forwarded-For'.
  -d, --delay int             Specify a delay between requests in milliseconds. Helps manage request rate (default: 0ms).
  -f, --folder string         Specify the folder location for payloads if not in the same directory as the executable.
  -H, --header strings        Add one or more custom headers to requests. Repeatable flag for multiple headers.
  -h, --help                  help for nomore403
      --http                  Use HTTP instead of HTTPS for requests defined in the request file.
  -t, --http-method string    Specify the HTTP method for the request (e.g., GET, POST). Default is 'GET'.
  -m, --max-goroutines int    Limit the maximum number of concurrent goroutines to manage load (default: 50). (default 50)
      --no-banner             Disable the display of the startup banner (default: banner shown).
  -x, --proxy string          Specify a proxy server for requests (e.g., 'http://server:port').
      --random-agent          Enable the use of a randomly selected User-Agent.
  -l, --rate-limit            Halt requests upon encountering a 429 (rate limit) HTTP status code.
  -r, --redirect              Automatically follow redirects in responses.
      --request-file string   Load request configuration and flags from a specified file.
      --status strings        Filter output by comma-separated status codes (e.g., 200,301,403)
  -k, --technique strings     Specify one or more attack techniques to use (e.g., headers,path-case). (default [verbs,verbs-case,headers,endpaths,midpaths,double-encoding,http-versions,path-case])
      --timeout int           Specify a max timeout time in ms. (default 6000)
      --unique                Show unique output based on status code and response length
  -u, --uri string            Specify the target URL for the request.
  -a, --user-agent string     Specify a custom User-Agent string for requests (default: 'nomore403').
  -v, --verbose               Enable verbose output for detailed request/response logging (not based on auto-calibrate).

Contributing

We welcome contributions of all forms. Here's how you can help:

• Report bugs and suggest features.
• Submit pull requests with bug fixes and new features.

Security Considerations

While nomore403 is designed for educational and ethical testing purposes, it's important to use it responsibly and with permission on target systems. Please adhere to local laws and guidelines.

License

nomore403 is released under the MIT License. See the LICENSE file for details.

Contact