DOCSEARCHbyAlgolia
Submit Docs

BypassPro

repository·main·Indexed 23 days ago

https://github.com/0x727/bypasspro

A Burp Suite plugin designed to automate and assist in finding bypass points for Access Control (401/403) and Web Application Firewall (WAF) protections. It features tools for discovering path traversal, parser differentials, and Unicode-based bypasses, including a Manual WAF Workbench and the Gh0st Bits module for testing Java ecosystem parsing differences such as char-to-byte truncation.

Tokens
6.8K
Snippets
10
Records
30
Agent score
30%

What's inside BypassPro

  1. Overview of BypassPro

    main

    BypassPro is a Burp Suite plugin designed to automate and assist in finding bypass points during penetration testing and offensive security operations. It focuses on two primary areas: Access Control Bypass (e.g., 401/403 bypass, Shiro permission bypass) and WAF (Web Application Firewall) Bypass.

    Key capabilities include:

    • Auto-Access Control Bypass: Automates suffix/prefix, boundary insertion, and header manipulation to bypass access controls.
    • Auto-WAF Bypass: Automatically generates WAF bypass variants using path/header deformation, various body charsets (UTF-16, UTF-32, etc.), Gzip transformations, and Content-Type disguises.
    • Manual WAF Workbench: A specialized workspace for manually constructing and testing WAF/parser bypasses with tools for obfuscation, encoding, character mutation, and header spoofing.
    • Gh0st Bits: A dedicated module for testing parsing differences in the Java ecosystem, specifically targeting char to byte truncation and loose parsing vulnerabilities.

  2. Understanding Ghost Bits candidate generation logic

    main

    BypassPro's Auto mode generates ghost:parser candidates based on specific patterns, such as percent-hex encoding differences.

    Example of candidate generation: If a path contains %2e (e.g., GET /api/%2e%2e/admin), the system might suggest a candidate like GET /api/%2>%2>/admin.

    Reasoning format: When a candidate is generated, the reason is provided in a format similar to: ghost:parser; scope:percent_hex; token:percent-hex; sender:burp; parser-diff only, not vulnerability confirmation

    False Positive Prevention: To avoid false positives (e.g., in JSON bodies containing strings like "name":"classic"), the system ensures that tokens like class are only flagged if they have clear boundaries or appear in meaningful semantic contexts like classLoader.

  3. Understand Gh0st Bits and Unicode Truncation

    main

    Gh0st Bits is a technique used to exploit parsing differences in the Java ecosystem, specifically where a char is truncated to a byte (e.g., ch & 0xFF).

    The Core Concept:

    1. An attacker designs a target ASCII/intermediate state (e.g., .%u002e).
    2. For each character, they select a Unicode character whose low 8 bits match the target ASCII character (unicodeChar & 0xff == targetAscii).
    3. The WAF sees the Unicode character and allows it.
    4. A backend layer performs a char to byte truncation, resulting in the original ASCII/intermediate state.

    Key Capabilities in BypassPro:

    • Ghost Encoding: Transforms selected text into Ghost characters using a 'Minimum Set' (only dangerous separators like . / \ % @ : ; ? & = ' " < > CR LF), 'Full Set' (all ASCII), or by character type (Alpha/Numeric/Symbol).
    • Ghost Restoration: Allows previewing the 8-bit or 7-bit (ch & 0x7F) restoration results or viewing candidates for a specific ASCII character.
    • Shuffle: Replaces current Ghost characters with a different set of Unicode characters that yield the same low-8-bit restoration. This is useful for determining if a WAF blocks specific literal characters or performs actual low-bit restoration detection.

    ⚠️ WARNING: Do NOT use the Shuffle feature on JDK URLDecoder or Fastjson Unicode Number templates. These vulnerabilities rely on actual Unicode numeric properties (e.g., Arabic numerals) rather than low-bit truncation. Shuffling will change the high bytes and break the mathematical meaning of the digits.

  4. Understand Gh0st Bits for parser testing

    main

    Gh0st Bits is a specialized feature for testing parser differences related to Java char to byte truncation, loose percent-hex parsing, and multi-stage decoding. It uses specific characters as a visual representation of bytes that may be restored differently by downstream components.

    Manual Capabilities:

    • Ghost encode: Generates encodings using minimal dangerous-sets, full ASCII, letters, digits, or symbols.
    • Ghost restore preview: Simulates low 8-bit or low 7-bit restoration.
    • Candidate lookup: Inspect possible Ghost characters for a single ASCII character.
    • Common payload helpers: Includes .%u002e, CRLF, .jsp, @type, and class.
    • Parser helpers: Includes fastjson \x4_, fastjson \u, jackson \u, Unicode digits, Jetty %2>, Fullwidth URL, and Tomcat %HH.

  5. Use Auto-Access Control Bypass

    main

    To automate the bypass of 401/403 errors or general access control restrictions:

    1. Entry Point: Right-click a request and select Send to BypassPro (Access Control), or trigger an Auto Scan from the Dashboard.
    2. Configuration: Behavior is controlled via the profiles.auto_access_bypass configuration.
    3. Mechanisms: The tool applies rules involving suffix, prefix, boundary_insert, and headers to find bypass vectors.

  6. Use the Manual WAF Workbench

    main

    The Manual WAF Workbench allows you to edit, combine, and send requests specifically tailored for WAF and parser bypass testing, similar to Burp Repeater but with specialized tools.

    1. Entry Point: Right-click a request and select Send to BypassPro (Manual WAF).
    2. Features:
      • Uses Burp's native IMessageEditor (Pretty, Raw, Hex modes).
      • Supports manual modification of Host, Port, and HTTPS.
      • Includes standard controls: Send, Cancel, Reset, Undo, Redo.
      • Supports Follow Redirect (max redirects configured via general.max_redirects, default is 3).
      • Maintains a History for easy replay and comparison.
    3. Tool Categories:
      • Obfuscation & Noise: Control characters, noise, path obfuscation, suffix/segment/boundary deformation.
      • Data Encoding: URL/Path encoding (including double/mixed), Unicode escape, Base64, charset encoding, and charset parameter position deformation.
      • Char Mutation: Full-width, homoglyphs, zero-width characters, and case deformation.
      • Header Spoof: Spoofing X-Forwarded-For, X-Client-IP, X-Remote-Addr, Referer, and HTTP/1.0.
      • Body Transform: Converting between form, multipart, and JSON; Gzip; and HTTP/1.0.
      • Gh0st Bits: Java char -> byte truncation, loose parsers, and template-based vulnerability chain construction.

  7. Use Auto Access Bypass for 401/403 testing

    main

    The Auto Access Bypass mode targets unauthorized access (401/403) vulnerabilities. It can be triggered via the Dashboard AutoScan or the Send to BypassPro (Access Control) context menu.

    It uses several rule groups to mutate requests:

    • suffix: Appends variants to the path.
    • prefix: Inserts variants before each path segment.
    • boundary_insert: Inserts tokens at directory boundaries.
    • headers: Adds or replaces spoofing headers.

    Results are recorded in the Dashboard when response status or body differences meet the configured similarity_threshold. The Reason column will indicate why a row was captured (e.g., status:403 -> 200 or sim:0.42 < 0.85).

  8. Recommended workflow for BypassPro

    main

    To effectively identify and test access control bypasses, follow this recommended three-step workflow:

    1. Auto Scan: Start with an automated scan to quickly cover common 401/403 scenarios across the site and identify potential bypass points.
    2. Active Mode Retesting: For suspicious requests identified during the scan, use the active mode to retest by right-clicking and initiating an Access Control or WAF bypass attempt.
    3. Manual WAF for Fine-grained Research: When deep analysis is required, send the request to the workbench to perform multiple rounds of payload mutation and comparison.

  9. Choose the right BypassPro entry point

    main

    BypassPro provides different entry points depending on your testing goal. Use the following guide to select the correct tool:

    GoalEntry PointLocationConfiguration Profile
    Automatically scan Proxy 401/403 responsesAutoScanDashboardprofiles.auto_access_bypass
    Test one specific request for access controlSend to BypassPro (Access Control)Context menuprofiles.auto_access_bypass
    Automatically generate WAF bypass variantsSend to BypassPro (WAF)Context menuprofiles.auto_waf_bypass
    Manual payload composition and byte-level testingSend to BypassPro (Manual WAF)Context menuprofiles.manual_waf_bypass

  10. Choose the correct BypassPro 5.1 entry point

    main

    BypassPro 5.1 provides four primary ways to interact with requests depending on your testing goal:

    Entry PointLocationBest Use CaseConfiguration Profile
    AutoScanDashboard AutoScan checkboxAutomatically monitor Proxy for 401/403 responses to find access control bypasses in bulk.profiles.auto_access_bypass
    Send to BypassPro (Access Control)Request right-click menuTest a single specific request for permission/access control bypasses.profiles.auto_access_bypass
    Send to BypassPro (WAF)Request right-click menuAutomatically generate WAF bypass variants for a single request.profiles.auto_waf_bypass
    Send to BypassPro (Manual WAF)Request right-click menuUse the manual workbench to manually select content, apply transformations, and use Raw/Burp sending.profiles.manual_waf_bypass

  11. Use Auto WAF Bypass for automated mutation

    main

    The Auto WAF Bypass mode automatically generates WAF bypass variants for a selected request via the Send to BypassPro (WAF) context menu. It uses the profiles.auto_waf_bypass configuration.

    Capabilities include:

    • Path and header mutation.
    • Body charset encoding: Supports UTF-16, UTF-16BE, UTF-16LE, UTF-32, UTF-32BE, UTF-32LE, and IBM037.
    • Gzip body transform.
    • Content-Type spoofing.
    • Gh0st Bits automatic candidate generation (mutates suspicious tokens or parser structures already present in the request).

    Note: Gh0st Bits candidates represent bytes that may be restored differently by downstream components; they are not a direct confirmation of a vulnerability.

  12. Quick Start with BypassPro

    main

    To begin using BypassPro for security testing, follow this recommended workflow:

    1. Automated Discovery: Enable AutoScan in the Dashboard to listen to Proxy responses and automatically identify 401/403 access-control bypass opportunities.
    2. Targeted Testing: For suspicious responses found in the Dashboard, re-test them using Send to BypassPro (Access Control) or Send to BypassPro (WAF) from the context menu.
    3. Iterative Research: Use the Manual WAF workbench for precise, byte-level payload composition and iterative testing.

    Note on Redirects: Only enable Follow Redirect if you specifically need to validate redirect chains. Keeping it off helps prevent confusing a redirect target with the actual fuzz target.