What problem does it solve? During authorized penetration tests, endpoints frequently return 401/403/405 responses that block further testing. This Skill provides a systematic decision tree for bypassing access controls on in-scope targets, turning blocked endpoints into testable attack surface. ## Core Features & Use Cases - Structured Bypass Decision Tree: Prioritizes JWT token attacks, path manipulation, HTTP method switching, header injection (X-Original-URL, X-Forwarded-For), and protocol downgrade in order of success rate. - Middleware-Specific Techniques: Provides targeted bypass payloads for Apache, Nginx, IIS/ASP.NET, Tomcat, and Spring servers. - JWT Attack Workflow: Covers Bearer prefix removal, alg:none confusion, secret brute forcing, and kid injection for Bearer-token-protected admin endpoints. - Use Case: During an authorized SRC assessment, an API fuzz phase finds /api/admin/users returning 403. The agent applies multi-position path fuzzing and header bypass, gains access, and hands the endpoint to the exploit phase. ## Quick Start Ask the agent to test the blocked endpoint /api/admin/users that returned 403 using the bypass decision tree and report any working technique.
