Repository navigation
feat(bypass): add static-asset extension in query string payloads - #61
Merged
Merged
Conversation
Adds the "?x=.js" family of payloads to the suffix-tricks technique and to payloads/endpaths. Why: a 403 bypass against Microsoft-Azure-Application-Gateway/v2 was reported (https://x.com/4osp3l, 2026-10-24) where appending "?x=.js" to a forbidden URL grants access. The gateway rule matches the full request URI against static-asset suffixes, so the request is classified as an asset and skips the restriction, while the origin ignores the query and serves the protected resource. nomore403 already tried extensions on the path (/admin.js) and arbitrary query parameters (?debug=1), but never an extension as a query value, so this variant was not covered. suffix-tricks now emits ?x=<ext> for .js/.css/.png/.ico/.svg, preserving the original query string when present. payloads/endpaths gains the same values plus bare ?.js/?.css/?.png so the default wordlist run also exercises the bypass. Tests pin both behaviours.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the
?x=.jsfamily of payloads to thesuffix-trickstechnique and topayloads/endpaths, plus tests and a README note.Why
A 403 bypass against
Microsoft-Azure-Application-Gateway/v2was reported by @4osp3l on 2026-10-24: a URL returns 403, and appending?x=.jsgrants direct access to the restricted resource.The mechanism is that the gateway rule matches the full request URI against static-asset suffixes.
/admin?x=.jsends in.js, so it is classified as a static asset and skips the restriction, while the origin ignores the unknown query parameter and serves/admin.nomore403 already covered two neighbours of this trick but not the trick itself:
/admin.js,/admin;.js,.css,.json) insuffix-tricksandendpaths?debug=1,?param,?download=1,?format=json) in bothNeither puts a static-asset extension as the query value, which is the condition that fires the Azure rule. This PR fills that gap.
Changes
cmd/requester.go:suffix-tricksemits?x=<ext>for.js,.css,.png,.ico,.svg. When the target already has a query string, the variant is emitted as?x=<ext>&<original query>so the original parameters are preserved, matching how the existing suffix payloads behave.payloads/endpaths: adds the same values plus bare?.js,?.css,?.png, so a default wordlist run also exercises the bypass.cmd/bypass_test.go:TestSuffixTricksSendsQueryExtensionVariants(asserts the three variants above, with and without original query) andTestEndPathsPayloadFileContainsQueryExtensionVariants(pins the shipped wordlist). Both were written first and failed before the implementation.README.md: documents the new variant undersuffix-tricks.Verification
Security review
Reviewed the diff for exploitable issues. The only sources are the target URL the operator supplies and static literals; the only sink is outbound requests to that target, which is the tool's purpose. No new parsing, no file or shell interaction, no secrets.
VERDICT: PASS