wstg-conf-06

Test HTTP Methods

跳到安装

仓库: CyberStrikeus/CyberStrike
最近来源活动: 2026年4月28日 23:54
检测到的 SKILL.md 语言: 英语
星标: 1,653
分支: 254

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-conf-06

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

wstg-conf-06

Test ID

WSTG-CONF-06

Test Name

Test HTTP Methods

High-Level Description

HTTP methods define the type of action to be performed on a resource. While GET and POST are commonly used, other methods like PUT, DELETE, TRACE, and OPTIONS may be enabled and exploitable. This test identifies which HTTP methods are supported by the web server and checks for potential security issues such as arbitrary file upload (PUT), file deletion (DELETE), cross-site tracing (TRACE), and access control bypasses.

What to Check

HTTP Methods to Test

Method	Purpose	Security Risk
GET	Retrieve resource	Authorization bypass
POST	Submit data	Authorization bypass
HEAD	Get headers only	Auth bypass, info disclosure
PUT	Upload/create resource	Arbitrary file upload
DELETE	Remove resource	Arbitrary file deletion
OPTIONS	List supported methods	Information disclosure
TRACE	Echo request (debug)	Cross-Site Tracing (XST)
CONNECT	TCP tunnel	Proxy abuse
PATCH	Partial modification	Data manipulation

Additional Checks

Method override headers
Access control per method
Arbitrary method handling
WebDAV methods (PROPFIND, COPY, MOVE, etc.)

How to Test

Step 1: Discover Supported Methods (OPTIONS)

# Send OPTIONS request
curl -X OPTIONS -I https://target.com/

# Check Allow header
curl -X OPTIONS -sI https://target.com/ | grep -i "allow"

# Example response:
# Allow: GET, HEAD, POST, OPTIONS

Step 2: Test Each Method

# Test all methods
methods=("GET" "POST" "HEAD" "PUT" "DELETE" "OPTIONS"
         "TRACE" "CONNECT" "PATCH" "PROPFIND" "PROPPATCH"
         "MKCOL" "COPY" "MOVE" "LOCK" "UNLOCK")

for method in "${methods[@]}"; do
    status=$(curl -s -o /dev/null -w "%{http_code}" -X $method https://target.com/)
    echo "$method: $status"
done

Step 3: Test PUT Method (File Upload)

# Test PUT for file upload
curl -X PUT https://target.com/test.txt -d "test content"
curl -X PUT https://target.com/test.html -d "<h1>Test</h1>"
curl -X PUT https://target.com/test.php -d "<?php phpinfo(); ?>"

# Check if file was created
curl -s https://target.com/test.txt
curl -s https://target.com/test.html
curl -s https://target.com/test.php

# WebDAV PUT
curl -X PUT https://target.com/test.txt \
    -H "Content-Type: text/plain" \
    -d "test content"

Step 4: Test DELETE Method

# Test DELETE (use non-critical path!)
curl -X DELETE https://target.com/test.txt -v

# Check response
# 200/204 = Successful deletion (CRITICAL!)
# 405 = Method not allowed (expected)
# 403 = Forbidden (access control working)

Step 5: Test TRACE Method (XST)

# Test TRACE
curl -X TRACE https://target.com/ -v

# TRACE should echo the request back
# If enabled, can be used for XST attacks to steal cookies

# Check response
# 200 with request echo = Vulnerable
# 405 = Method disabled (secure)

Step 6: Test Access Control Bypass

# Test protected page with different methods
protected_url="https://target.com/admin/"

# Normal request (may redirect to login)
curl -sI "$protected_url"

# Try different methods
for method in HEAD POST PUT OPTIONS PATCH; do
    echo "=== $method ==="
    curl -s -o /dev/null -w "%{http_code}" -X $method "$protected_url"
done

# Try arbitrary method
curl -s -o /dev/null -w "%{http_code}" -X FAKE "$protected_url"
curl -s -o /dev/null -w "%{http_code}" -X FOO "$protected_url"

Step 7: Test Method Override Headers

# Method override through headers
# If PUT returns 405, try override

# X-HTTP-Method-Override
curl -X POST https://target.com/resource \
    -H "X-HTTP-Method-Override: PUT" \
    -d "content=test"

# X-HTTP-Method
curl -X POST https://target.com/resource \
    -H "X-HTTP-Method: DELETE"

# X-Method-Override
curl -X POST https://target.com/resource \
    -H "X-Method-Override: PUT"

# _method parameter (Rails, Laravel)
curl -X POST https://target.com/resource \
    -d "_method=DELETE"

Step 8: Test WebDAV Methods

# WebDAV specific methods
# PROPFIND - Get properties
curl -X PROPFIND https://target.com/ \
    -H "Depth: 1" \
    -H "Content-Type: application/xml" \
    -d '<?xml version="1.0"?><propfind xmlns="DAV:"><allprop/></propfind>'

# MKCOL - Create directory
curl -X MKCOL https://target.com/newdir/

# COPY - Copy resource
curl -X COPY https://target.com/file.txt \
    -H "Destination: https://target.com/file_copy.txt"

# MOVE - Move resource
curl -X MOVE https://target.com/file.txt \
    -H "Destination: https://target.com/moved_file.txt"

Step 9: Nmap HTTP Methods Script

# Nmap script for HTTP methods
nmap -p 80,443 --script http-methods target.com

# With URL path
nmap -p 80,443 --script http-methods --script-args http-methods.url-path='/admin/' target.com

# Detailed output
nmap -p 80,443 --script http-methods --script-args http-methods.test-all=true target.com

Tools

Command-Line Tools

Tool	Description	Usage
curl	HTTP client	`curl -X METHOD url`
Nmap	NSE scripts	`nmap --script http-methods`
Netcat	Raw requests	Manual HTTP crafting

Web Proxies

Tool	Description
Burp Suite	Repeater for method testing
OWASP ZAP	Request editor
mitmproxy	Scripted testing

Scanners

Tool	Description
Nikto	Web server scanner
Nessus	Vulnerability scanner

Example Commands/Payloads

Comprehensive HTTP Methods Test Script

#!/bin/bash
TARGET=$1
PATH_TO_TEST=${2:-"/"}

echo "=== HTTP METHODS TEST ==="
echo "Target: $TARGET$PATH_TO_TEST"
echo ""

# Standard methods
echo "[+] Testing standard methods..."
methods=("GET" "POST" "HEAD" "PUT" "DELETE" "OPTIONS" "TRACE" "PATCH")

for method in "${methods[@]}"; do
    response=$(curl -s -o /dev/null -w "%{http_code}" -X $method "https://$TARGET$PATH_TO_TEST")
    echo "  $method: $response"

    # Flag potentially dangerous enabled methods
    if [ "$method" == "PUT" ] && [ "$response" != "405" ] && [ "$response" != "501" ]; then
        echo "    [!] WARNING: PUT may be enabled!"
    fi
    if [ "$method" == "DELETE" ] && [  !=  ] && [  !=  ]; 
         
    
     [  ==  ] && [  ==  ]; 
         
    



 
 
webdav=(      )

 method  ; 
    response=$(curl -s -o /dev/null -w  -X  )
     [  !=  ] && [  !=  ]; 
         
    



 
 
response=$(curl -s -o /dev/null -w  -X FOOBAR )
 
 [  ==  ]; 
     



 
 
 header    ; 
    response=$(curl -s -o /dev/null -w  -X POST \
        -H  )

PUT File Upload Test

#!/bin/bash
TARGET=$1
UPLOAD_PATH="/test_upload_$(date +%s).txt"

echo "[+] Testing PUT file upload to $TARGET$UPLOAD_PATH"

# Attempt upload
response=$(curl -s -o /dev/null -w "%{http_code}" -X PUT \
    "https://$TARGET$UPLOAD_PATH" \
    -H "Content-Type: text/plain" \
    -d "PUT upload test - $(date)")

echo "PUT Response: $response"

if [ "$response" == "201" ] || [ "$response" == "200" ] || [ "$response" == "204" ]; then
    echo "[!] CRITICAL: PUT upload successful!"

    # Verify file exists
    verify=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$UPLOAD_PATH")
    if [ "$verify" == "200" ]; then
        echo "[!] File confirmed accessible at $UPLOAD_PATH"
        echo "[!] Attempting cleanup..."
        curl -X DELETE "https://$TARGET$UPLOAD_PATH"
    fi
else
    echo "[+] PUT upload not allowed (secure)"

Remediation Guide

1. Disable Unnecessary Methods

Apache

# Allow only GET, POST, HEAD
<Directory />
    <LimitExcept GET POST HEAD>
        Require all denied
    </LimitExcept>
</Directory>

# Disable TRACE
TraceEnable Off

Nginx

# Allow only specific methods
if ($request_method !~ ^(GET|POST|HEAD)$) {
    return 405;
}

IIS (web.config)

<system.webServer>
    <security>
        <requestFiltering>
            <verbs>
                <add verb="PUT" allowed="false" />
                <add verb="DELETE" allowed="false" />
                <add verb="TRACE" allowed="false" />
                <add verb="OPTIONS" allowed="false" />
            </verbs>
        </requestFiltering>
    </security>
</system.webServer>

2. Disable WebDAV (if not needed)

# Apache - disable WebDAV module
# Remove or comment out:
# LoadModule dav_module modules/mod_dav.so
# LoadModule dav_fs_module modules/mod_dav_fs.so

3. Consistent Access Control

# Apply same authorization for all methods
@app.route('/resource', methods=['GET', 'POST', 'PUT', 'DELETE'])
@require_authentication
def resource():
    # Authorization applied to all methods
    pass

4. Disable Method Override

# Django - don't use X-HTTP-Method-Override middleware
# Remove: 'django.middleware.http.MethodOverrideMiddleware'

Risk Assessment

CVSS Score

Finding	CVSS	Severity
PUT enabled (file upload)	9.8	Critical
DELETE enabled	8.1	High
TRACE enabled	5.3	Medium
Auth bypass via method	8.8	High
WebDAV enabled	7.5	High

PUT Enabled Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE Categories

CWE ID	Title	Description
CWE-749	Exposed Dangerous Method	Dangerous HTTP methods enabled
CWE-650	Trusting HTTP Permission Methods	Insufficient method authorization
CWE-434	Unrestricted Upload of File	PUT file upload

References

Checklist

[ ] OPTIONS request sent to enumerate methods
[ ] GET method tested
[ ] POST method tested
[ ] HEAD method tested
[ ] PUT method tested (file upload)
[ ] DELETE method tested
[ ] TRACE method tested
[ ] PATCH method tested
[ ] WebDAV methods tested (PROPFIND, etc.)
[ ] Arbitrary method tested (FOOBAR)
[ ] Method override headers tested
[ ] Access control per method verified
[ ] Dangerous methods documented
[ ] Risk assessment completed

name	wstg-conf-06
description	Test HTTP Methods
category	configuration
owasp_id	WSTG-CONF-06
version	1.0.0
author	cyberstrike-official
tags	["misconfiguration","hardening","server","wstg","conf"]
tech_stack	[]
cwe_ids	["CWE-200"]

name	wstg-conf-06
description	Test HTTP Methods
category	configuration
owasp_id	WSTG-CONF-06
version	1.0.0
author	cyberstrike-official
tags	["misconfiguration","hardening","server","wstg","conf"]
tech_stack	[]
cwe_ids	["CWE-200"]

wstg-conf-06

来源信息

安装方式

检查来源文件

同仓库更多 Skills

同仓库更多 Skills

wstg-conf-06

Test ID

Test Name

High-Level Description

What to Check

HTTP Methods to Test

Additional Checks

How to Test

Step 1: Discover Supported Methods (OPTIONS)

Step 2: Test Each Method

Step 3: Test PUT Method (File Upload)

Step 4: Test DELETE Method

Step 5: Test TRACE Method (XST)

Step 6: Test Access Control Bypass

Step 7: Test Method Override Headers

Step 8: Test WebDAV Methods

Step 9: Nmap HTTP Methods Script

Tools

Command-Line Tools

Web Proxies

Scanners

Example Commands/Payloads

Comprehensive HTTP Methods Test Script

PUT File Upload Test

Remediation Guide

1. Disable Unnecessary Methods

Apache

Nginx

IIS (web.config)

2. Disable WebDAV (if not needed)

3. Consistent Access Control

4. Disable Method Override

Risk Assessment

CVSS Score

CWE Categories

References

Checklist