page1.php on this challenge shows you 403 Access Denied.

In this case, you’ll want to intercept the request to page1.php in Burp Suite

• Burp Suite Setup Directions.

One way to discover the answer is to FUZZ this site using a requests file.

• After intercepting the request, right-click and choose ‘copy to file’
• I’ll save this file as file.req

Open up the file in pico

pico file.req

Under the Host: header, add FUZZ:127.0.0.1

• We’ll fuzz for headers that might bypass 403 errors like this.

Then download the wordlist below using wget

• This wordlist is explicitly designed to bypass 403 restrictions where possible.

<https://gist.githubusercontent.com/kaimi-/6b3c99538dce9e3d29ad647b325007c1/raw/921b0dd64e01c31106ece6087a3582e2d6fc6bc2/gistfile1.txt>

If you cat the file, you’ll see this list contains standard headers that can be used to bypass 403 errors.