How can I figure out what user agents are allowed by a specific webpage given that it is not explicitly stated when I fail to access it with my current browser?

  • 2
    I'm not sure this is a security question. The quick answer is to fuzz the user-agent string in the headers with burp.
    – schroeder
    Commented Apr 5, 2017 at 9:51
  • @schroeder I'm trying to bypass the user-agent authentication for a specific website as a CTF misson so I guess it is related to security? And do you mind explaining how your answer works?
    – user143969
    Commented Apr 5, 2017 at 9:58
  • 1
    There are tools that will replace parts of the header with alternate strings to determine if the target behaves differently. What you could do is to dump all the user-agent strings in a file and try them all. But, since you say that it is a CTF, there are likely clues as to which user-agent string you are supposed to use. Then you simply use a user-agent switcher plugin on your browser.
    – schroeder
    Commented Apr 5, 2017 at 10:09
  • @schroeder Thank you for the reply! I am aware of user-agent switcher, however I am pretty sure they used a custom user agent and I am wondering if there is any information I can obtain from any part/layer of the webpage that might tell me what the custom user agent is
    – user143969
    Commented Apr 5, 2017 at 10:36
  • @user143969: it fully depends on the code rejecting/allowing specific user-agents. If this code returns information to the client which UA are accepted then you get these information, if not then not. There is nothing in the HTTP protocol which mandates a specific way for this. Commented Apr 5, 2017 at 11:30

2 Answers 2


Thanks everyone for your help! It ended up to be really stupid. They displayed a message saying only 'His User Agent' is allowed, and the user agent actually ended up being ("His User Agent"). Should have tried this to begin with, guess I thought too much into it.


When your server doesn't tell you something that only the server knows, there logically can only be one way to figure out:


Good luck!

  • Dear downvoter, see the first word in my sentence: when your server doesn't... This is a CTF. Giving the OP help is right. doing more: meh. Commented Apr 5, 2017 at 15:13
  • 1
    I think a one-word recommendation would have worked perfectly as a comment instead of an answer. :)
    – Arminius
    Commented Apr 6, 2017 at 2:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .