403 / Access-control bypass
When a path returns 401/403, try to reach it another way. Path-normalization disagreements between the edge (Nginx/HAProxy/CDN) and the app, plus trusted-header quirks, are the reliable wins on modern stacks.
Stop after confirmation. Do not escalate impact without separate authorization.
Trailing-character path variants
Reverse-proxy ACL and the app router normalise differently. Effective against Nginx/Tomcat/Spring fronting an app.
/admin//admin/./admin///admin/.//admin%20/admin%09/admin?/admin#
Encoded traversal / dot-segments
Path is re-normalised after the ACL check. `..;/` is a Tomcat/Spring path-parameter trick that still lands in 2024-25.
/%2e/admin/admin/..;//./admin/..%2f/admin/%2e%2e/admin/..%2f/admin
URL-rewrite override headers
Symfony / Nginx rewrites route on these. Send the request to `/` with the header pointing at the protected path.
X-Original-URL: /adminX-Rewrite-URL: /adminX-Override-URL: /admin
Trusted-source spoof headers
Panels gated to internal/localhost frequently trust a client-supplied forwarded header.
X-Forwarded-For: 127.0.0.1X-Real-IP: 127.0.0.1X-Forwarded-Host: localhostX-Custom-IP-Authorization: 127.0.0.1Client-IP: 127.0.0.1
Method / version swap + origin
ACLs often match only GET; the framework still dispatches other verbs. Also try HTTP/1.0 or hit the origin IP directly to skip the edge ACL.
POST /adminPUT /adminPATCH /adminTRACE /adminGET /admin HTTP/1.0
Version history: normalized permanent page created 2026-08-20.