> For the complete documentation index, see [llms.txt](https://wiki.zacheller.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.zacheller.dev/web-app-pentest/upload-download/error-only-.md-and-.pdf-files-are-allowed.md).

# Download Bypass: Poison Null Byte

Error: Only .md and .pdf files are allowed!

If you cannot download files of a certain type, try a character bypass called "Poison Null Byte". A Poison Null Byte looks like this: %00.  The Poison Null Byte will now look like this: %2500. Adding this and then a **.md** to the end will bypass the 403 error!

e.g. \<url>/ftp/package.json.bak%2500.md