devploit/nomore403 ? reverse-engineered prompt

Build me a Go command line tool that helps security testers find possible 401 and 403 bypasses on a target URL.

It should send a baseline request first, optionally check a few fake paths to learn the site’s normal error response, then try a bunch of request mutations like different headers, methods, path tricks, host changes, and raw request forms. I want it to compare results against the blocked response, score the interesting ones, and filter out noisy false positives so the most likely bypasses stand out clearly.

Please make it support a single URL, a list of URLs from a file or stdin, proxy support, verbose mode, and output that can be read by other tools, including JSON or JSONL. It should also print easy to replay evidence, like curl commands, for anything that looks promising.

If you need current details from docs or libraries, look them up online and iterate until it feels solid.