| name | probing-dangerous-http-methods |
| description | Probe a target for HTTP methods that should not be enabled in
production — TRACE (XST attack), unrestricted PUT/DELETE,
DEBUG/CONNECT, WebDAV (PROPFIND/MKCOL/COPY/MOVE), and Allow header
enumeration.
Use when: penetration test rules of engagement include HTTP method
testing, OR a load balancer change went live and you suspect default
methods were exposed.
Threshold: TRACE returns 200 on any path (XST), PUT/DELETE returns
anything other than 405/403/404 on a non-API endpoint, OPTIONS Allow
header lists DEBUG/CONNECT/PROPFIND, or WebDAV methods succeed.
Trigger with: "audit http methods", "trace check", "options
enumeration", "webdav probe".
|
| allowed-tools | ["Read","Bash(python3:*)","Bash(curl:*)"] |
| disallowed-tools | ["Bash(rm:*)","Edit(/etc/*)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","http-methods","xst","webdav","pentest"] |
Probing Dangerous HTTP Methods
Overview
Most HTTP methods beyond GET/POST/HEAD are vestigial — leftover from
WebDAV authoring stacks of the early 2000s, debugging features in
legacy servers, or default-enabled methods nobody disabled at install
time. Each enabled method that the application doesn't use is an
attack surface: TRACE enables Cross-Site Tracing (XST), PUT enables
arbitrary file upload to unprotected paths, CONNECT enables proxy
abuse against internal services, WebDAV enables directory manipulation.
This skill probes the canonical method set and grades each based on
its presence and response.
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
| TRACE method enabled | HIGH | TRACE returns 200 with request echo | OWASP A05:2021, CWE-693 |
| PUT method enabled outside API path | HIGH | PUT returns 200/201/204 on non-API path | CWE-434 |
| DELETE method enabled outside API path | HIGH | DELETE returns 200/204 on non-API path | CWE-285 |
| CONNECT method enabled | CRITICAL | CONNECT returns 200 (proxy abuse open) | CWE-441 |
| DEBUG method enabled | HIGH | DEBUG returns response (legacy IIS / dev servers) | CWE-489 |
| WebDAV methods enabled (PROPFIND/MKCOL/COPY/MOVE) | HIGH | Any return 207 or 201 | CWE-538 |
| Allow header discloses unused methods | LOW | OPTIONS Allow includes methods app doesn't use | CWE-200 |
| OPTIONS returns full method enumeration | LOW | Allow:* or broad list | CWE-200 |
Prerequisites
- Python 3.9+
- Authorization for non-local targets
Instructions
Step 1 — Confirm authorization
"Do you have authorization to perform HTTP method probing on this
target? I need confirmation before proceeding."
Step 2 — Run the scanner
python3 ${CLAUDE_PLUGIN_ROOT}/skills/probing-dangerous-http-methods/scripts/probe_methods.py \
https://example.com \
--authorized
