360 prompts the server to turn on WebDAV shutdown method _ server Other

WebDAV (web-based Distributed Authoring and Versioning) a communication protocol based on the HTTP 1.1 protocol. It extends HTTP 1.1, in Get, POST, Several HTTP standard methods, such as head, add new methods that enable applications to directly read and write directly to Web servers, support write-file locking (locking) and unlock (Unlock), and support versioning of files.

Description: The target opens WebDAV.

WebDAV (web-based Distributed Authoring and Versioning) is an extended protocol based on HTTP 1.1, which adds new methods based on the standard method of HTTP definition, These methods allow applications to write, delete files, and so on, directly on the Web server.
Hazard:
1. If WebDAV is improperly configured, an attacker would have the possibility to modify, delete, and upload arbitrary files anonymously to the content of the Web site, which could result in the attacker having full control of the target Web server.

2. Some older versions of Web servers have many serious security vulnerabilities for components that implement WebDAV-related functionality, and can be exploited by hackers to control the entire server, even if WebDAV permissions are configured correctly.

Solution:

1, if not absolutely necessary, please close WebDAV;
2, if you do need this feature, please update your Web server to the latest version and configure the access rights for WebDAV correctly.

Close Method:

Disabling WebDAV in IIS6 is simply a matter of locating the Application Server section in Windows 2003 installation and uninstall Windows components, entering the IIS component options, removing the check in front of WebDAV, and then restarting IIS.



Both Microsoft windows2000/xp and IE, Office, and Adobe/macromedia DW support WebDAV, which greatly enhances the value and performance of Web applications. For users who need a lot of content to publish, applying WebDAV can reduce the dependency on the CMS system and create more freedom. Uploading, downloading becomes easy.
Web Distributed Authoring and Versioning (WebDAV) extends the http/1.1 protocol, allowing clients to publish, lock, and manage resources on the web, after integration with IIS.

WebDAV allows the client to do the following:

Processes resources in the WebDAV publishing directory on the server. With this feature, the benefits include:
1. Users with the correct permissions can copy and move files in a WebDAV directory.
2. Modify the properties associated with some resources. For example, a user can write and retrieve property information for a file.
3. Lock and unlock resources so that multiple users can read a file at the same time. But only one person can modify the file at a time.
4. Search the contents and properties of files in a WebDAV directory.
Setting up a WebDAV publishing directory on a server is as simple as setting up a virtual directory through the Internet information Services snap-in. Once you have set up the publishing directory, users with the appropriate permissions can publish the document to the server and work with the files in the directory. Before you set up a WebDAV directory, you must first install Windows XP Professional.

WebDAV Client

You can access the WebDAV publishing directory from any of the Microsoft products described in the list below or through any other client that supports the industry standard WebDAV protocol.
· Windows XP connects to a WebDAV server through the Add Network Places Wizard and displays the contents of a WebDAV directory as if it were part of the same file system on the local computer. After the connection is complete, you can drag and drop files, retrieve and modify file properties, and perform many other file system tasks.
· Internet Explorer 5.0 is connected to a WebDAV directory, allowing you to perform file system tasks that you can perform through Windows XP.
· Office 2000 creates, publishes, edits, and saves documents directly to a WebDAV directory through any of the applications it contains.
Searching in WebDAV
Once you have established a connection to the WebDAV directory, you can quickly search for the contents and properties of the files in this directory. For example, you can search for include
All documents of the Word table or all documents written by Fred.

Integrated Security

Because WebDAV is integrated with Windows XP and IIS, it has the security features provided by both. These include the IIS permissions specified in the Internet information Services snap-in and the discretionary access Control List (DACL) in the NTFS file system. For information about IIS security, see Security.
Because a client with the appropriate permissions can write to a WebDAV directory, it is always important to control which clients are allowed to access the directory. To help you control access permissions, IIS has built-in support for the Kerberos 5 authentication protocol, which enhances the functionality of integrated Windows authentication. Select integrated Windows authentication to ensure that only clients with permissions can access the WebDAV directory on the Intranet and write to it. For more information about how the Kerberos 5 authentication protocol integrates with IIS for Windows authentication collaboration, see Integrated Windows Authentication. For general information about how the Kerberos protocol works, see "Kerberos V5 Authentication" in the Windows XP documentation.
In addition, IIS supports Digest authentication and Advanced Digest authentication. Digest authentication and Advanced Digest authentication are created for Windows domain servers, providing more stringent security measures for passwords and the transmission of information over the Internet. For information about Digest authentication, see Digest Authentication and Configuration Digest authentication. For information about Advanced Digest authentication, see Advanced Digest authentication and configuring Advanced Digest Authentication.

the advantages of WebDAV

Since the WEB has become the foundation of the Internet, HTTP 1.1 (Hypertext Transfer Protocol) is proven to be a very flexible generic protocol used to transmit data. However, HTTP has some obvious drawbacks that limit its adoption as a comprehensive Internet communication protocol: It is ideal for static documents for viewing, but it does not provide a way to process documents in ways that are complex enough to provide rich authoring capabilities to clients.
For example, an "update lost" problem occurs when two authors make changes to a document at the same time without communicating. Only modifications made by the last author and uploaded to the server by the modified document will be retained, and the changes made by another author will be lost.
The goal of the IETF WebDAV workgroup is to design a protocol that provides the functionality required by any Distributed authoring tool in a standards-based forum. The current WebDAV specification (IETF RFC 2518) addresses the three main issues of collaborative authoring tools:
· Overwrite protection. HTTP 1.1 does not ensure that clients can protect resources and can make changes while other clients edit them at the same time. With WebDAV, you can lock resources in a variety of ways so that other clients know that you are interested in the resources being discussed, or prevent other clients from accessing the resource.
· Resource management. HTTP can only access a single resource directly. WebDAV provides a way to organize your data more efficiently. WebDAV introduces the concept of a collection that can contain resources (similar to a file system folder). Resource management through WebDAV includes the ability to create, move, copy, and delete collections, as well as resources or files in the collection.
· Document properties. Different types of data have unique properties that help describe the data. For example, in an e-mail message, these properties may be the sender's name and the time the message was received. In a collaboration document, these properties may be the name of the original author of the document and the name of the last editor. Because people use different types of documents, the list of possible property types becomes infinitely larger. XML is an extensible communication tool required for WebDAV.

the format of the WebDAV request

HTTP 1.1 (see IETF RFC 2068) provides a set of methods that clients can communicate with the server and specifies the format of the response, which returns the requesting client from the server. WebDAV uses all of the methods in this specification, extends some of these methods, and introduces other methods that can provide the described functionality. The methods used in WebDAV include:
1.Options, head and Trace.
Primarily used by applications to discover and service support and network behavior.
2.Get.
Retrieves a document.
3.Put and Post.
Submit the document to the server.
4.Delete.
Destroys a resource or collection.
5. Mkcol.
Create a collection.
6.PropFind and Proppatch.
Retrieves and sets properties for resources and collections.
7.Copy and move.
Manages collections and resources in a namespace context.
8. Lock and Unlock.
Overwrite protection.
The general structure of WebDAV requests follows the format of HTTP.
and is composed of the following three components:
1. Methods. Declares a method executed by the client (the method described above).
2. Header. Describes instructions for how to accomplish this task.
3. Subject (optional). Defines the data used in this directive or other instruction to describe how to complete this method.
In the principal component, XML becomes the key element in the entire WebDAV structure.