GoNMF

NoMoreForbidden is a tool that tries various techniques to bypass forbidden(403) pages on websites and presents their results to the user. Now with GO.

Note

You can try this tool with https://github.com/akinerkisa/renikApp 403 vulnerable page section.

Installation

git clone https://github.com/akinerkisa/GoNMF

cd GoNMF

go mod tidy

Usage

go run main.go -u https://www.example.com/test

Flag	Description	Example	Default
-u	Specify URL	go run main.go -u https://www.example.com/test	N/A
-ip	Specify ip adress for ip-based headers	go run main.go -ip 1.1.1.1	127.0.0.1
-v	Toggles showing all Valid/Invalid results	go run main.go -v on/off	off

Features

Url based bypass ( url.com/path/../ etc.)

Ip-based header bypass ( X-Forwarded-For etc.)

Web cache based header bypass ( X-Original-URL etc.)

Path char change based bypass (admin to aDmIn)

Protocol change based bypass (http to https - https to http)

Wayback Machine history check

False-Positive result detection

Ip Adress based bypass -new v0.2

HTTP Protocol version based bypass -new v0.2

How to work False-Positive Detection

https://google.com/test/../ etc. payloads or X-Original-URL etc. headers such as has a high false-positive rate. NoMoreForbidden is compares main page response length and bypass result response length. If them is equal, at high rate this result is false-positive. However, this system cannot always be trusted. On some websites (eg google.com) page lengths vary and this prevents the program from detecting false-positive.

How to work CDN/WAF && Cloudflare - Cloudfront Detection

IP address-based bypass only works with the origin IP. If the target uses services like Cloudflare or CloudFront, we cannot access the original IP. While testing IP address bypass, NMF checks the server, and if the website uses Cloudflare or CloudFront, NMF notifies the user of this. Additionally, SSL Handshake failed error may also indicate a cdn/waf. This is also notified to the user.

References

https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/403-and-401-bypasses https://github.com/akinerkisa/NoMoreForbidden