HTTP 403

Exactly.

If a script tries to hit an API and receives, for example, an HTTP 403 forbidden error,

Which is basically the server saying, I understand what you want, but you don't have the permissions to see it.

Right.

Yes.

It's programmed to solve the problem.

So when it hits that HTTP 403 error, the agent's internal logic dictates, OK, that approach failed, the password must be wrong, or my query format is incorrect.

Let me mutate the parameters and try again.

Please do remember to subscribe, check out the show notes, share us on the socials.

And speaking of that HTTP 403 status code, check out Don't by MechaMicro.

Add some music to your week.

We'll see you next time on Application Security Weekly.