Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-03The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Based on SOC occupation classification
Showing SKILL.md
| name | wstg-inpv-03 |
| description | Testing for HTTP Verb Tampering |
| category | input-validation |
| owasp_id | WSTG-INPV-03 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | ["CWE-89"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-03
Testing for HTTP Verb Tampering
HTTP Verb Tampering exploits web servers or applications that respond differently to various HTTP methods (GET, POST, PUT, DELETE, etc.). Attackers may bypass security controls by using alternative HTTP methods that aren't properly restricted, potentially gaining unauthorized access to protected resources.
#!/bin/bash
TARGET="https://target.com"
ENDPOINT="/admin"
# Test common HTTP methods
METHODS=("GET" "POST" "PUT" "DELETE" "PATCH" "HEAD" "OPTIONS" "TRACE" "CONNECT")
echo "[*] Testing HTTP methods on $TARGET$ENDPOINT"
for method in "${METHODS[@]}"; do
response=$(curl -s -o /dev/null -w "%{http_code}" -X "$method" "$TARGET$ENDPOINT")
echo " $method: "
-e
curl -s -I -X OPTIONS | grep -i
-e
curl -s -o /dev/null -w -X
#!/usr/bin/env python3
"""
HTTP Verb Tampering Vulnerability Tester
"""
import requests
from requests.auth import HTTPBasicAuth
class VerbTamperingTester:
def __init__(self, base_url):
self.base_url = base_url
self.findings = []
self.session = requests.Session()
HTTP_METHODS = [
'GET', 'POST', 'PUT', 'DELETE', 'PATCH',
'HEAD', 'OPTIONS', 'TRACE', 'CONNECT',
'PROPFIND', 'PROPPATCH', 'MKCOL', 'COPY', 'MOVE',
'LOCK', 'UNLOCK', 'VERSION-CONTROL', 'REPORT',
'CHECKOUT', 'CHECKIN', 'UNCHECKOUT',
# Arbitrary methods (should be rejected)
'JEFF', 'FAKE', 'TEST', 'DEBUG'
]
def test_methods(self, endpoint):
"""Test all HTTP methods on endpoint"""
print(f"\n[*] Testing methods on {endpoint}")
results = {}
url = f"{self.base_url}{endpoint}"
for method in self.HTTP_METHODS:
try:
response = self.session.request(method, url, timeout=10)
results[method] = {
'status': response.status_code,
'length': len(response.content)
}
print(f" {method}: {response.status_code} ({len(response.content)} bytes)")
except Exception as e:
results[method] = {'status': 'Error', 'error': str(e)}
return results
def test_auth_bypass(self, protected_endpoint, valid_creds=None):
"""Test if authentication can be bypassed via method change"""
print(f"\n[*] Testing authentication bypass...")
url = f"{self.base_url}{protected_endpoint}"
# Get baseline with authentication
if valid_creds:
auth = HTTPBasicAuth(valid_creds[0], valid_creds[1])
auth_response = self.session.get(url, auth=auth)
print(f" Authenticated GET: {auth_response.status_code}")
# Get baseline without authentication
unauth_get = self.session.get(url)
print(f" Unauthenticated GET: {unauth_get.status_code}")
# Test other methods without authentication
bypass_methods = ['POST', 'PUT', 'HEAD', 'OPTIONS', 'TRACE', 'JEFF']
for method in bypass_methods:
try:
response = self.session.request(method, url)
# Check if we get different (successful) response
if response.status_code == 200 and unauth_get.status_code in [401, 403]:
print(f" [VULN] {method} bypasses authentication! ({response.status_code})")
self.findings.append({
'type': 'Authentication Bypass',
'method': method,
'endpoint': protected_endpoint,
'severity': 'Critical'
})
except:
pass
def test_authorization_bypass(self, admin_endpoint, user_session):
"""Test if authorization can be bypassed via method change"""
print(f"\n[*] Testing authorization bypass...")
url = f"{self.base_url}{admin_endpoint}"
self.session.cookies.update(user_session)
# Test access with regular user credentials
methods = ['GET', 'POST', 'PUT', 'DELETE', 'HEAD', 'JEFF']
for method in methods:
try:
response = self.session.request(method, url)
if response.status_code == 200:
# Check if response contains admin content
if 'admin' in response.text.lower() or len(response.content) > 100:
print(f" [WARN] {method} returns content ({response.status_code})")
self.findings.append({
'type': 'Potential Authorization Bypass',
'method': method,
'endpoint': admin_endpoint,
'severity': 'High'
})
except:
pass
def test_trace_xst(self):
"""Test for Cross-Site Tracing (XST) via TRACE method"""
print(f"\n[*] Testing for XST (TRACE method)...")
url = self.base_url
headers = {'X-Custom-Header': 'XST-Test-Value'}
try:
response = self.session.request('TRACE', url, headers=headers)
if response.status_code == 200:
if 'XST-Test-Value' in response.text:
print(f" [VULN] TRACE method enabled - XST possible!")
self.findings.append({
'type': 'Cross-Site Tracing (XST)',
'method': 'TRACE',
'severity': 'Medium',
'detail': 'TRACE reflects headers including cookies'
})
else:
print(f" [INFO] TRACE enabled but not reflecting headers")
else:
print(f" [OK] TRACE method disabled ({response.status_code})")
except:
pass
def test_webdav_methods(self):
"""Test for WebDAV methods"""
print(f"\n[*] Testing WebDAV methods...")
webdav_methods = ['PROPFIND', 'PROPPATCH', 'MKCOL', 'COPY', 'MOVE', 'LOCK', 'UNLOCK']
for method in webdav_methods:
try:
response = self.session.request(method, self.base_url)
if response.status_code not in [405, 501]:
print(f" [WARN] {method} enabled ({response.status_code})")
self.findings.append({
'type': 'WebDAV Method Enabled',
'method': method,
'severity': 'Low',
'detail': 'WebDAV methods should be disabled if not needed'
})
except:
pass
def generate_report(self):
"""Generate findings report"""
print("\n" + "="*60)
print("HTTP VERB TAMPERING REPORT")
print("="*60)
if not self.findings:
print("\nNo significant vulnerabilities found.")
else:
for f in self.findings:
print(f"\n[{f['severity']}] {f['type']}")
print(f" Method: {f['method']}")
if 'endpoint' in f:
print(f" Endpoint: {f['endpoint']}")
if 'detail' in f:
print(f" Detail: {f['detail']}")
def run_tests(self, endpoints=None):
"""Run all verb tampering tests"""
if endpoints is None:
endpoints = ['/admin', '/api/admin', '/dashboard', '/settings']
for endpoint in endpoints:
self.test_methods(endpoint)
self.test_auth_bypass('/admin')
self.test_trace_xst()
self.test_webdav_methods()
self.generate_report()
# Usage
tester = VerbTamperingTester("https://target.com")
tester.run_tests()
#!/bin/bash
TARGET="https://target.com/admin"
# Test method override headers
echo "[*] Testing method override headers..."
# X-HTTP-Method-Override
curl -s -X POST -H "X-HTTP-Method-Override: DELETE" "$TARGET" -o /dev/null -w "X-HTTP-Method-Override: DELETE -> %{http_code}\n"
# X-HTTP-Method
curl -s -X POST -H "X-HTTP-Method: PUT" "$TARGET" -o /dev/null -w "X-HTTP-Method: PUT -> %{http_code}\n"
# X-Method-Override
curl -s -X POST -H "X-Method-Override: PATCH" "$TARGET" -o /dev/null -w "X-Method-Override: PATCH -> %{http_code}\n"
# Query parameter method override
curl -s -X POST "$TARGET?_method=DELETE" -o /dev/null -w "_method=DELETE parameter -> %{http_code}\n"
# Body parameter override
curl -s -X POST -d "_method=DELETE" "$TARGET" -o /dev/null -w "_method=DELETE body -> %{http_code}\n"
# Burp Suite Intruder configuration
# Position: HTTP method
# Payload list:
GET
POST
PUT
DELETE
PATCH
HEAD
OPTIONS
TRACE
CONNECT
PROPFIND
COPY
MOVE
LOCK
UNLOCK
MKCOL
FAKE
# Also test with authentication removed
# Compare response codes and lengths
| Tool | Purpose |
|---|---|
| curl | Manual method testing |
| Burp Suite | Intercept and modify methods |
| Nmap http-methods | Script for method enumeration |
| OWASP ZAP | Web scanner |
# Python/Flask - Explicitly define allowed methods
from flask import Flask, request, abort
app = Flask(__name__)
# Only allow specific methods per endpoint
@app.route('/api/resource', methods=['GET', 'POST'])
def resource():
if request.method == 'GET':
return get_resource()
elif request.method == 'POST':
return create_resource()
# Deny all other methods globally
@app.before_request
def check_method():
allowed = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD', 'OPTIONS']
if request.method not in allowed:
abort(405)
# Disable TRACE
@app.after_request
def disable_trace(response):
if request.method == 'TRACE':
return '', 405
return response
# Nginx - Restrict HTTP methods
location /admin {
limit_except GET POST {
deny all;
}
# Disable TRACE
if ($request_method = TRACE) {
return 405;
}
}
# Apache - Restrict methods
<Location "/admin">
<LimitExcept GET POST>
Require all denied
</LimitExcept>
# Disable TRACE
TraceEnable off
</Location>
| Finding | CVSS | Severity |
|---|---|---|
| Authentication bypass via method | 9.8 | Critical |
| Authorization bypass via method | 8.1 | High |
| TRACE method enabled (XST) | 5.3 | Medium |
| WebDAV methods enabled | 4.3 | Medium |
| Arbitrary methods accepted | 3.1 | Low |
| CWE ID | Title |
|---|---|
| CWE-650 | Trusting HTTP Permission Methods on the Server Side |
[ ] All HTTP methods tested
[ ] Authentication bypass tested
[ ] Authorization bypass tested
[ ] TRACE method tested (XST)
[ ] WebDAV methods tested
[ ] Method override headers tested
[ ] Arbitrary methods tested
[ ] Findings documented