NoMore403

Table of Contents

• Introduction
• Features
• Implemented Bypass Techniques
• Prerequisites
• Installation
• How It Works
• Customization
• Usage
• Options
• Common Use Cases
• Contributing
• Security Considerations
• License
• Acknowledgments
• Contact

Introduction

nomore403 is a tool designed to help cybersecurity professionals bypass HTTP 40X errors encountered during web security assessments. It automates various techniques to navigate past access restrictions, from header manipulation to method tampering, with smart output filtering to highlight only the results that matter.

Features

• Auto-calibration: Multi-sample calibration with tolerance detection to accurately identify successful bypasses
• Smart filtering: Automatically hides results matching the default response, showing only interesting differences
• Deduplication: Groups repeated results per technique, showing up to 3 examples with a summary count
• Retry with backoff: Automatic retries on transient errors (timeouts, connection resets) with exponential backoff
• Progress tracking: Per-technique progress bar on TTY terminals, with clean output in pipes/CI
• Color-coded output: Status codes and content-length are colored based on significance (green = likely bypass, red = blocked)
• Multiple bypass techniques: Implements 8 different techniques to bypass restrictions
• High concurrency: Uses goroutines for fast and efficient testing
• Customizable: Easily add new payloads and techniques

Implemented Bypass Techniques

• Verb Tampering: Tests different HTTP methods to access protected resources
• Verb Case Switching: Manipulates HTTP method capitalization to detect incorrect implementations
• Headers: Injects headers designed for bypassing like X-Forwarded-For, X-Original-URL, etc.
• Custom Paths: Tests alternative paths that can bypass access restrictions
• Path Traversal (midpaths): Inserts patterns in the middle of paths to confuse parsers
• Double-Encoding: Uses double URL encoding to evade filters
• HTTP Versions: Tests different HTTP versions (1.0, 1.1) to identify inconsistent behaviors
• Path Case Switching: Manipulates uppercase/lowercase in paths to detect case-sensitive configurations

Prerequisites

Before you install and run nomore403, make sure you have the following:

• Go 1.24 or higher installed on your machine.

Installation

Compile from Source

This is the recommended method as it ensures you have all necessary files, including the payloads folder:

git clone https://github.com/devploit/nomore403
cd nomore403
go get
go build

From Releases

You can download pre-compiled binaries for your OS from our Releases page.

Important: When installing via pre-compiled binaries, the payloads folder might not be included. If that's the case, download it separately:

# After downloading the binary
git clone --depth 1 https://github.com/devploit/nomore403.git
cp -r nomore403/payloads /path/to/your/preferred/location
# Then use nomore403 with -f flag
nomore403 -u https://domain.com/admin -f /path/to/your/preferred/location/payloads

From Go install

You can install nomore403 directly with Go:

go install github.com/devploit/nomore403@latest

Important: When installing via go install, the payloads folder will not be included. You'll need to download it separately:

# After installing with go install
git clone --depth 1 https://github.com/devploit/nomore403.git
cp -r nomore403/payloads /path/to/your/preferred/location
# Then use nomore403 with -f flag
nomore403 -u https://domain.com/admin -f /path/to/your/preferred/location/payloads

How It Works

1. Auto-calibration: Makes 3 requests to non-existent paths and calculates the average response size with a dynamic tolerance range. This creates a reliable baseline to filter false positives.
2. Default request: Makes a standard request to the target to capture the "blocked" response signature (status code + content-length).
3. Technique execution: Runs selected techniques concurrently with per-technique progress bars. Requests are retried automatically on transient errors with exponential backoff.
4. Smart filtering: Only shows responses that differ meaningfully from the default blocked response — different status code or significantly different content-length. Repeated identical results are deduplicated with a summary count.

Customization

To edit or add new bypasses, modify the payloads directly in the payloads folder. nomore403 will automatically incorporate these changes.

Payloads Folder Structure

• headers: Headers used for bypassing
• ips: IP addresses to inject in specific headers
• httpmethods: Alternative HTTP methods
• endpaths: Custom paths to add at the end of the target URL
• midpaths: Patterns to insert in the middle of paths
• simpleheaders: Common simple headers
• useragents: List of User-Agents for rotation

Usage

Output example

━━━━━━━━━━━━━━━━━ NOMORE403 ━━━━━━━━━━━━━━━━━━
  Target: https://domain.com/admin
  Method: GET User-Agent: nomore403
  Timeout: 6000ms Delay: 0ms
  Proxy: - Bypass IP: -
  Flags: -
  Techniques: verbs, verbs-case, headers, endpaths, midpaths, double-encoding, http-versions, path-case
  Payloads: payloads

━━━━━━━━━━━━━━━ AUTO-CALIBRATION RESULTS ━━━━━━━━━━━━━━━
[✔] Calibration samples: 3
[✔] Status Code: 404
[✔] Avg Content Length: 1821 bytes (tolerance: ±50)

━━━━━━━━━━━━━ DEFAULT REQUEST ━━━━━━━━━━━━━
403 	          429 bytes https://domain.com/admin

━━━━━━━━━━━━━ VERB TAMPERING ━━━━━━━━━━━━━━

━━━━━ VERB TAMPERING CASE SWITCHING ━━━━━━━

━━━━━━━━━━━━━ HEADERS ━━━━━━━━━━━━━━━━━━━━━
200 	         2047 bytes X-Original-URL: /admin
200 	         2047 bytes X-Rewrite-URL: /admin
200 	         2047 bytes X-Custom-IP-Authorization: 127.0.0.1
  ... and 12 more with 200/2047 bytes (use -v to see all)

━━━━━━━━━━━━━ CUSTOM PATHS ━━━━━━━━━━━━━━━━
200 	         2047 bytes https://domain.com/;///..admin

━━━━━━━━━━━━━ MIDPATHS ━━━━━━━━━━━━━━━━━━━━

━━━━━━━━━━━━━ DOUBLE-ENCODING ━━━━━━━━━━━━━

━━━━━━━━━━━━━ HTTP VERSIONS ━━━━━━━━━━━━━━━

━━━━━━━━━━ PATH CASE SWITCHING ━━━━━━━━━━━━
200 	         2047 bytes https://domain.com/%61dmin

Basic Usage

./nomore403 -u https://domain.com/admin

Verbose Mode + Proxy + Specific techniques to use

./nomore403 -u https://domain.com/admin -x http://127.0.0.1:8080 -k headers,http-versions -v

Parse request from Burp

./nomore403 --request-file request.txt

Use custom header + specific IP address for bypasses

./nomore403 -u https://domain.com/admin -H "Environment: Staging" -i 8.8.8.8

Set new max of goroutines + add delay between requests

./nomore403 -u https://domain.com/admin -m 10 -d 200

Filter by specific status codes

./nomore403 -u https://domain.com/admin --status 200,302

Pipe URLs from stdin

cat urls.txt | ./nomore403

Options

./nomore403 -h
Command line application that automates different ways to bypass 40X codes.

Usage:
  nomore403 [flags]

Flags:
  -i, --bypass-ip string      Use a specified IP address or hostname for bypassing access controls. Injects this IP in headers like 'X-Forwarded-For'.
  -d, --delay int             Specify a delay between requests in milliseconds. Helps manage request rate (default: 0ms).
  -f, --folder string         Specify the folder location for payloads if not in the same directory as the executable.
  -H, --header strings        Add one or more custom headers to requests. Repeatable flag for multiple headers.
  -h, --help                  help for nomore403
      --http                  Use HTTP instead of HTTPS for requests defined in the request file.
  -t, --http-method string    Specify the HTTP method for the request (e.g., GET, POST). Default is 'GET'.
  -m, --max-goroutines int    Limit the maximum number of concurrent goroutines to manage load (default: 50). (default 50)
      --no-banner             Disable the display of the startup banner (default: banner shown).
  -x, --proxy string          Specify a proxy server for requests (e.g., 'http://server:port').
      --random-agent          Enable the use of a randomly selected User-Agent.
  -l, --rate-limit            Halt requests upon encountering a 429 (rate limit) HTTP status code.
  -r, --redirect              Automatically follow redirects in responses.
      --request-file string   Load request configuration and flags from a specified file.
      --status strings        Filter output by comma-separated status codes (e.g., 200,301,403)
  -k, --technique strings     Specify one or more attack techniques to use (e.g., headers,path-case). (default [verbs,verbs-case,headers,endpaths,midpaths,double-encoding,http-versions,path-case])
      --timeout int           Specify a max timeout time in ms. (default 6000)
      --unique                Show unique output based on status code and response length.
  -u, --uri string            Specify the target URL for the request.
  -a, --user-agent string     Specify a custom User-Agent string for requests (default: 'nomore403').
  -v, --verbose               Enable verbose output for detailed request/response logging (not based on auto-calibrate).
      --version               version for nomore403

Common Use Cases

• Security Audits: Identify misconfigurations in authentication systems
• Bug Bounty: Discover bypasses in protected endpoints
• Penetration Testing: Gain access to restricted areas during assessments
• Hardening: Verify the robustness of implemented protections

Contributing

We welcome contributions of all forms. Here's how you can help:

• Report bugs and suggest features
• Submit pull requests with bug fixes and new features
• Add new payloads to existing folders

Security Considerations

While nomore403 is designed for educational and ethical testing purposes, it's important to use it responsibly and with permission on target systems. Please adhere to local laws and guidelines.

License

nomore403 is released under the MIT License. See the LICENSE file for details.

Acknowledgments

NoMore403 draws inspiration from several projects in the web security space:

• Dontgo403 - The predecessor to NoMore403
• The cybersecurity community for documenting and sharing bypass techniques
• All contributors who have helped improve this tool

Contact