Unsecured HTTP method is enabled

Source: Internet
Author: User

Security Risks:Web pages, scripts, and files may be uploaded, modified, or deleted on the Web server. Possible causes:The WEB server or application server is configured in an insecure manner. Revised recommendations:If the server does not need to support WebDAV, be sure to disable it or disallow unnecessary HTTP methods. Introduction to the method:In addition to the standard get and post methods, HTTP requests use a variety of other methods. Many of these methods are mainly used to accomplish uncommon and special tasks. If these methods are accessible to low-privileged users, they can then implement effective attacks against the application. Here are some notable ways to do this:
PUT Uploading files to a specified directory
DELETE Delete the specified resource
COPY Copies the specified resource to the location specified by the destination message header
MOVE Moves the specified resource to the location specified by the destination message header
SEARCH Search for resources in a directory path
PROPFIND Gets information about the specified resource, such as author, size, and content type
TRACE Returns the original request received by the server in the response
Several of these methods belong to the HTTP protocol WebDAV (web-based distributed Authoring and Versioning) extension. penetration test steps:Use the Options method to list the HTTP methods used by the server. Note that the methods that are activated in different directories may vary. Many times, it is advised that some methods are effective, but they are not actually used. Sometimes, even if a method is not listed in the response returned by the options request, the method is still available. Test each method manually to verify that it is available. To test with Curl:

Curl -v -X OPTIONS http://www.example.com/test/

View the allow:get of the response, HEAD, POST,PUT,DELETE, OPTIONS

Curl -v -T test. HTML http://www.example.com/test/test.html

See if it can be uploaded to determine if the attack takes effect. Find a page that exists, such as test2.html

Curl -X DELETE http://www.example.com/test/test2.html

If the deletion succeeds, the attack is valid. Solution:such as Tomcat, configure Web. xml

<security-constraint>
<web-resource-collection>
<web-resource-name>Fortune</web-resource-name>
<url-pattern>/*</url-pattern>
PUT DELETE</HTTP-METHOD>
head</HTTP-METHOD>
< Http-method>options</HTTP-METHOD>
trace</HTTP-METHOD>
</WEB-RESOURCE-COLLECTION>
</SECURITY-CONSTRAINT>
<LOGIN-CONFIG>
<auth-method> basic</AUTH-METHOD>
</login-config>

Reboot tomcat to complete. The above code is added to an application and can also be added to the Tomcat Web. XML, except that adding to an app is only valid for one app, and if added to the Tomcat Web. XML, it is valid for all apps under Tomcat.

Unsecured HTTP method is enabled

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.