Skip to content

Latest commit

 

History

History
18 lines (13 loc) · 739 Bytes

README.md

File metadata and controls

18 lines (13 loc) · 739 Bytes
Raw

URL Fuzzer 401/403 Bypass

Fuzz the URL with all available ASCII characters to identify parser inconsistencies. Based on the work of Rafael da Costa Santos (https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies) and Orange Tsai (https://youtu.be/28xWcRegncw?si=t6BcScfQsz-2wFap).

Demo

Demo.mp4

How it works

Inserts all ASCII characters (0-255) at pre-defined insertion points in the URL. For the path /admin/dashboard, the following transformations are done:

  • 0x85/admin/dashboard
  • /0x85/admin0x85/dashboard
  • /admin0x85/dashboard
  • /admin/dashboard0x85
  • /admin/dashboard/0x85/

etc...