Pentest tool for bypassing 4xx restrictions and spotting unusual 200 OK responses.
Quickly uncovers misconfigurations and weak access controls.
pipx install multibypassusage: multibypass [-X ] [-H ] [-d ] [-b ] [-A ] [-x ] [-L] [-k] [-m ] [-h] [-D ] [-t ] [-s] [-o ] [-q] [-v] [-C] [-n] [-l] [-V] [-j] [-i ] [-w ] url Pentest tool for bypassing restricted access using various techniques. REQUIRED: url Target URL HTTP OPTIONS: -X, --request HTTP method to use (default: GET) -H, --header Add an HTTP header (default: []) -d, --data HTTP request data (default: None) -b, --cookie Add a cookie (default: []) -A, --user-agent Set the User-Agent (default: Mozilla/5.0) -x, --proxy HTTP proxy to use (e.g. http://127.0.0.1:8080) (default: None) -L, --location Follow redirects (default: False) -k, --insecure Allow insecure connections (default: False) -m, --max-time Request timeout in seconds (default: 10) GENERAL OPTIONS: -h, --help Show this help message -D, --delay Delay or delay range between requests (e.g. 0.2 or 0.5-2) (default: 0) -t, --threads Number of threads (default: 32) -s, --stop Stop if the target returns HTTP 429 Too Many Requests (default: False) OUTPUT OPTIONS: -o, --output Write output to file (default: None) -q, --quiet Only show the final analysis (default: False) -v, --verbose Display extra debugging information (default: False) -C, --curl Show recommended curl commands (default: False) -n, --no-color Disable log colorization (default: False) ATTACK OPTIONS: -l, --light Perform a light attack (default: False) -V, --variations Also test case variations (default: False) -j, --json Always use a json body (default: False) -i, --ip Add a custom IP for spoofing attacks (default: []) -w, --wordlists Use a custom wordlist directory (default: install-dir/wordlists) Use non-standard or alternative HTTP methods to bypass access controls.
Examples:
- If
GET /adminis blocked thenPOST /admin,HEAD /adminorTRACE /admincan work. - Some WAFs/firewalls only filter
GET/POSTand let others through. GET /admin?method=POST
Add an header to impersonate a trusted client, such as an internal, localhost or corporate IP.
Examples:
X-Forwarded-For: 127.0.0.1X-Client-IP: 10.0.0.1X-Real-IP: 127.0.0.1
Some servers or filters are case-sensitive, others are not. Changing letter case can bypass filters.
Examples:
/ADMINvs/admin/file.PHpvs/file.php
Look for misconfigured or forgotten backup/temporary files that bypass access restrictions.
Examples:
/admin.bak,/admin.old,/index.php~,/config.php.save- Git/SVN metadata:
/.git/,/.svn/ - IDE/editor leftovers:
index.php.swp,index.php.bak
Some applications apply filters or restrictions only to certain clients. Changing the User-Agent header can bypass these filters or reveal hidden functionality.
Examples:
- Search engine crawler:
User-Agent: Googlebot/2.1 - Custom:
User-Agent: Admin
Trick input validation and filtering logic.
Examples:
- Encoding:
%2E%2E%2F - Double encoding:
%252E%252E%252F - Path traversal:
../