skills.rest
lycheer1126
lycheer1126COMMUNITY
Explore all skills by this author →
GitHub

api-gateway-bypass

Tests API gateway access control bypasses via path normalization and method override discrepancies.

2|1|Updated Aug 28, 2026
Search Tags:#access control#penetration testing#nginx#bypass#api gateway#kong#path normalization
One-click install
npx skills add https://github.com/lycheer1126/xs-bigdan --skill api-gateway-bypass-lycheer1126
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: api-gateway-bypass
Source: https://github.com/lycheer1126/xs-bigdan/tree/main/knowledge/skills/api_gateway_bypass
Command: npx skills add https://github.com/lycheer1126/xs-bigdan --skill api-gateway-bypass-lycheer1126

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When an API gateway returns 403 for protected routes, testers need a systematic way to check whether the gateway and backend normalize paths differently, because that mismatch can expose admin APIs to unauthorized access. ## Core Features & Use Cases - Path Normalization Payloads: Provides dot-segment, double-slash, URL-encoding, semicolon, and backslash variants that exploit gateway/backend parsing differences. - Method Override & Version Fallback: Covers X-HTTP-Method-Override headers and legacy API version paths (v1, unversioned) that gateways forget to protect. - Gateway-Specific Techniques: Documents Kong, Nginx, and AWS API Gateway specific bypasses, plus rate-limit evasion and API documentation discovery (swagger.json, /v3/api-docs). - Use Case: During an authorized SRC test, a target returns a Kong-flavored 403 on /api/admin; apply the normalization payload list to find /api/%2e/admin reaches the backend, then confirm with a rejected-vs-bypassed request pair as evidence. ## Quick Start Ask the agent to test the target's 403 API gateway endpoints for path normalization and method override bypasses using this manual.

Frequently Asked Questions about api-gateway-bypass

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I bypass API gateway 403 restrictions?▼

Test path normalization differences between the gateway and backend: try variants like /api/./admin, /api//admin, /api/%2e/admin, and semicolon or backslash forms. If the gateway and backend normalize differently, one variant may reach the protected resource.

How to test HTTP method override headers for access control bypass?▼

Send X-HTTP-Method-Override, X-HTTP-Method, or X-Method-Override headers with values like DELETE or PUT against endpoints where the gateway only blocks certain methods. Some frameworks also accept a ?_method=DELETE URL parameter.

What are common Kong or Nginx API gateway bypass techniques?▼

For Kong, try double slashes and %2f encodings that its router and upstream normalize differently. For Nginx, merge_slashes off lets //admin pass through, and proxy_pass path rewriting can make a blocked location resolve to a different backend route.

Does rate limit bypass with X-Forwarded-For work on API gateways?▼

It works when the backend trusts X-Forwarded-For for rate limiting; rotating the header value resets the counter. Endpoint variants like trailing slashes or case changes also evade per-path counters, but only use this within authorized testing scope.

When should API gateway bypass testing not be used?▼

Only use it on explicitly authorized targets such as SRC-listed scopes or written engagements. Stop after proving reachability of the protected resource, do not pivot to internal networks, and report findings to the program before disclosing reproducible details.

Related Skills

Explore More Software Engineering Skills→
devtintdevtint

waf-bypass

Identify and bypass Web Application Firewalls during API penetration testing.

Community
Intermediate
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-fix-review

Review security patches for root-cause coverage and bypass risks.

Official
Advanced
sayseven7sayseven7
11

api-recon-and-docs

Discover API endpoints, schemas, versions, and hidden documentation paths.

Community
Intermediate
Wyl-cmdWyl-cmd
6

hack

Routes web and API security testing tasks to appropriate vulnerability category skills.

Community
Intermediate