360 prompt that WebDAV is enabled on the server

Web-based Distributed Authoring and Versioning is a communication protocol based on the HTTP 1.1 protocol. it extends HTTP 1.1 and adds some new methods in addition to GET, POST, HEAD, and other HTTP standard methods so that applications can directly read and write to the Web Server, it also supports write Locking and Unlock, and supports file version control.

Description: WebDAV is enabled for the target.

WebDAV (Web-based Distributed Authoring and Versioning) is an extension protocol based on HTTP 1.1. It adds some new methods based on the standard methods defined by HTTP, using these methods, applications can directly write or delete files on the WEB server.
Hazards:
1. If WebDAV is improperly configured, attackers can modify, delete, and upload arbitrary files on the website anonymously. This may cause attackers to have full control over the target WEB server.

2. some older versions of WEB servers that implement WEBDAV-related functions have many serious security vulnerabilities, even if the WebDAV permission is correctly configured, attackers may exploit the components on the server to control the entire server.

Solution:

1. Disable webDAV if necessary;
2. If this function is required, update your WEB server to the latest version, and correctly configure the webDAV access permissions.

Close method:

It is very easy to Disable WebDAV in IIS6. You only need to find the application server section in Windows 2003 installation and uninstall Windows components, and enter the IIS component option to remove the WebDAV check box, then restart IIS.

Microsoft windows2000, XP, IE, Office, and Adobe/MacroMedia DW support Webdav, which greatly enhances the value and efficiency of Web applications. For users who need to publish a large amount of content, applying WebDav can reduce their dependence on the CMS system and create content more freely. Easy upload and download.
Web Distributed creation and Version Management (WebDAV) extends the HTTP/1.1 protocol, allowing the client to publish, lock, and manage Web resources, after being integrated with IIS.

WebDAV allows the client to perform the following operations:

Process resources in the WebDAV release directory on the server. This function has the following advantages:
1. users with the correct permissions can copy and move files in the WebDAV Directory.
2. Modify the attributes associated with some resources. For example, you can write and retrieve the attributes of a file.
3. Lock and unlock resources so that multiple users can read one file at a time. However, only one person can modify the file at a time.
4. Search for the content and attributes of files in the WebDAV Directory.
Setting the WebDAV publishing directory on the server is as simple as setting the virtual directory through the Internet Information Service Management Unit. After the release directory is set, users with proper permissions can publish documents to the server and process files in the directory. Before setting the WebDAV Directory, you must first install Windows XP Professional.

WebDAV client

You can access the WebDAV publishing directory through any Microsoft product described in the following list or any other client that supports the industry standard WebDAV protocol.
· Windows XP connects to the WebDAV server through the "add network neighbor wizard" and displays the content in the WebDAV Directory, just as it is part of the same file system on the local computer. After the connection is complete, you can drag and drop files, retrieve and modify file attributes, and execute many other file system tasks.
· Internet Explorer 5.0 is connected to the WebDAV Directory, allowing you to execute file system tasks that can be executed through Windows XP.
· Office 2000 creates, publishes, and edits any application contained in it and directly saves the document to the WebDAV Directory.
Search in WebDAV
Once you establish a connection with the WebDAV Directory, you can quickly search for the content and attributes of files in this directory. For example, you can search for include
All the files in table or all the files written by Fred.

Integration Security

Because WebDAV has been integrated with Windows XP and IIS, it has the security features provided by both. This includes the specified IIS permission in the Internet Information Service Management Unit and the free selection of access control list (DACL) in the NTFS file system ). For IIS security information, see Security.
As a client with proper permissions can write to the WebDAV directory, it is always important to control which clients are allowed to access the directory. To help you control access permissions, IIS has built-in support for the Kerberos 5 authentication protocol, thus enhancing the integration of Windows authentication. By integrating Windows authentication, you can ensure that only authorized clients can access the WebDAV directory on the Intranet and perform write operations on it. For more information about how the Kerberos 5 authentication protocol integrates Windows Authentication with IIS, see integrated Windows authentication. For more information about how the Kerberos protocol works, see "Kerberos v5 authentication" in the Windows XP document ".
In addition, IIS supports digest authentication and advanced digest authentication. Digest authentication and advanced digest authentication are created for Windows Domain servers and provide stricter security measures for passwords and information transmitted over the Internet. For information about digest authentication, see Digest authentication and configure digest authentication. For more information about advanced digest authentication, see advanced digest authentication and configure advanced digest authentication.

WebDAV advantages

As Web has become the foundation of the Internet, HTTP 1.1 (Hypertext Transfer Protocol) has been proved to be a very flexible universal protocol for data transmission. However, HTTP has some obvious disadvantages, which limits its use as a comprehensive Internet communication protocol: It is very suitable for viewing static documents, however, it cannot provide a method that is complex enough to provide rich creation functions to the client.
For example, if two authors modify a document without communication, the "Update loss" issue may occur. Modifications made by the last author and uploaded to the server are retained, and changes made by the other author are lost.
The IETF WebDAV workgroup aims to design a protocol that provides the functions required by any distributed creation tool in a standard-based forum. The current WebDAV specification (ietf rfc 2518) addresses three main issues of collaborative creation tools:
· Rewrite protection. HTTP 1.1 cannot ensure that the client can protect resources and make changes when other clients edit them at the same time. WebDAV can be used to lock resources in multiple ways, so that other clients can know that you are interested in the resources discussed, or prevent other clients from accessing the resources.
· Resource management. HTTP can only directly access a single resource. WebDAV provides a more effective way to organize data. WebDAV introduces a collection of resources (similar to a file system folder. Resource management through WebDAV includes the following functions: creating, moving, copying, and deleting a set, and resources or files in the set.
· Document attributes. Different types of data have unique attributes, which helps describe data. For example, in an email, these attributes may be the sender's name and receipt time. In a collaboration document, these attributes may be the name of the original author of the document and the name of the last editer. Because different types of documents are used, the list of possible attribute types becomes infinitely large. XML is a scalable communication tool required by WebDAV.

WebDAV request format

HTTP 1.1 (see ietf rfc 2068) provides a set of methods for the client to communicate with the server, and specifies the format of the response (returned from the server to send requests. WebDAV fully adopts all the methods in this specification, extends some of these methods, and introduces other methods that can provide the described functions. WebDAV uses the following methods:
1. Options, Head, and Trace.
Applications are used to discover and track server support and network behavior.
2. Get.
Search documents.
3. Put and Post.
Submit the document to the server.
4. Delete.
Destroys resources or collections.
5. Mkcol.
Create a collection.
6. PropFind and PropPatch.
Search and Set Properties for resources and collections.
7. Copy and Move.
Manage the set and resources in the namespace context.
8. Lock and Unlock.
Rewrite protection.
The general structure of WebDAV requests follows the HTTP format,
It consists of the following three components:
1. method. Declare the method executed by the client (the method described above ).
2. header. Describes instructions on how to complete this task.
3. Subject (optional ). Defines the data used in this instruction or other instructions to describe how to complete this method.
In the main component, XML becomes a key element in the whole WebDAV structure.