unKover is a compact Bash + curl utility that probes 403/401 responses for access-control misconfigurations during authorized penetration tests, emitting a curl PoC on success.
| Tool | BRuteLogic/unKover — a 403/401 bypass tester written in pure Bash, part of the King of Noobs recon suite |
| Category | Web access-control testing / offensive recon |
| Primary Use | Testing whether endpoints returning 403 Forbidden or 401 Unauthorized are actually protected, via header spoofing, method tampering, and path manipulation, with --prefix and -j options |
| Safe Use | For authorized penetration tests, bug bounty engagements, and lab environments such as the vendor's public testbed; not for use against systems you do not own or have permission to test |
| Telemetry Note | Generates a burst of rapid, patterned requests with anomalous headers and encoded paths against a single URL — highly visible in WAF logs, rate limiters, and access-control monitoring |
unKover is the newest entry in the King of Noobs suite by Brute Logic, and it addresses one of the oldest and most persistent classes of web misconfiguration: the endpoint that answers with 403 Forbidden or 401 Unauthorized but whose protection is enforced inconsistently. Rather than treating the status code as a wall, the tool treats it as a hypothesis to be falsified, running a battery of known bypass techniques against the URL and halting at the first one that changes the outcome. The repository reports 119 stars and is written entirely in Shell, which already tells you a great deal about its design philosophy before you read a line of code.
What the README makes clear up front is the tool's scope: it takes a URL that returns 403 or 401, applies a curated set of proven bypass techniques, and on success returns a ready-to-run curl proof of concept. The named technique families include IP header spoofing, RFC 7239 Forwarded header spoofing, method tampering, protocol headers, path normalization, URL encoding, HTTP/1.0 downgrade, hop-by-hop headers, path suffix injection, and API version prefix bypass. Each of these attacks a different layer of the authorization stack — client identity inference, request routing, path resolution, or protocol handling — which is why a single-layer ACL so often fails against at least one of them.
The invocation surface is deliberately minimal: bash unkover <URL> [--prefix /v2] [-j|--json]. The --prefix flag is the most interesting argument, because it encodes a real-world failure pattern the README describes explicitly: servers that protect /admin but forget to protect /v2/admin or /api/admin. Prefix drift is endemic in API deployments where new versions are rolled out alongside old ones and the ACL rules only ever get written for the original path. The -j flag switches output to JSON with metadata including tool version, timestamp, elapsed time, findings, and the baseline response, which makes the tool usable as a component in a larger scripted assessment pipeline rather than just an interactive check.
Two usage patterns are documented in the README, and they are all an operator needs: bash unkover https://target.com/admin for a plain run and bash unkover https://target.com/admin --prefix /v2 for prefix testing. The examples point at target.com, a stand-in for whatever in-scope host the engagement defines. Defenders reading this should note that output shows which technique is being tested in real time, and that on a bypass the tool reports the technique name, the PoC curl command, and the result status and size — the size field matters because it helps distinguish a genuine content change from a redirect or error page that merely returned a different status code.
The Why Bash? section is more than a stylistic preference; it is a supply-chain argument. The author's position is that with no runtime, no pip install, and no npm, there is no dependency chain to poison. Bash and curl ship on effectively every Linux system, and the script is short enough that, in the author's words, it is auditable by anyone in seconds. That last claim is the operative one: in an era where single-file reconnaissance utilities routinely pull hundreds of transitive dependencies, a tool you can read in one sitting carries real operational value. Short means readable, readable means auditable, and auditable means trustworthy — that is the suite's stated KISS and Pareto principle applied to security tooling itself.
Context matters here, because unKover does not work alone. It is one of four tools in the King of Noobs family: reKon acts as the master orchestrator running a full recon pipeline, disKovery handles subdomain discovery, reKover performs URL mapping through passive, brute-force, and crawling approaches, and unKover closes the loop by interrogating the access controls on the URLs the others surface. This placement tells you the intended workflow — you do not feed it random URLs, you feed it endpoints that earlier reconnaissance has already established exist. The naming convention, with the uppercase K in every tool name worn deliberately as a badge, is a self-aware inversion of an insult the author received for sharing things in the simplest possible way.
For testing competence, the README offers something unusually considerate: a live testbed at hxxps://403[.]brutelogic[.]net/access built specifically for the tool, with multiple server configurations across nginx and Apache exposing different bypass vectors. This is the right place to learn the tool's behavior — it belongs to the tool's author, is purpose-built for this exercise, and removes any ambiguity about authorization. Running against a lab of your own construction before touching a client engagement is standard practice anyway, and having a vendor-hosted target with deliberately varied configurations lets you observe which technique classes fire against which server stacks.
From a defensive standpoint, everything unKover does is noisy in a characteristic way. A single URL probed with IP-spoofing headers, Forwarded variants, alternate HTTP methods, encoded and normalized path forms, and HTTP/1.0 requests produces a tight temporal cluster of anomalous requests sharing the same destination. WAF rules keyed on X-Forwarded-For anomalies, mismatched method-to-path ACL expectations, and double-encoding patterns will light up, and even without a WAF the access log signature — many near-identical requests differing only in headers and path encoding within seconds — is trivially detectable. Blue teams can use the tool's technique list as a checklist: if any of these request shapes changes your authorization outcome, the fix is to enforce access control at the application layer with canonical path matching, not to rely on reverse-proxy rules or client-supplied identity headers.
Where unKover fits in an authorized workflow is precisely at the boundary between reconnaissance and exploitation. A consultant with written permission to test example[.]com uses it to validate that the 403 on a sensitive path is a genuine denial rather than a filter that can be routed around; the output curl PoC then becomes the evidence artifact in the report, demonstrating impact without requiring the tester to escalate further. The JSON mode supports this reporting use case directly, timestamping findings and capturing the baseline response so the delta between allowed and denied is documented. That report-ready posture is a good indicator of the tool's intended audience: professionals who need reproducible proof, not volume.
The license is MIT, there is no runtime beyond the shell, and the default branch is main with no topics declared — the project's identity lives entirely in the README's philosophy and the tool's brevity. For teams that maintain their own internal utilities, unKover is worth reading even if you never run it: the technique taxonomy alone is a compact map of how access-control enforcement fails in practice across nginx, Apache, and API gateway configurations. And for testers, it is a reminder that the humblest tooling — a Bash script wrapping curl — often covers the gap between what a server says is forbidden and what it actually enforces.
BRuteLogic/unKover.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.