Unsecured HTTP method is enabled

Security Risks:Web pages, scripts, and files may be uploaded, modified, or deleted on the Web server. Possible causes:The WEB server or application server is configured in an insecure manner. Revised recommendations:If the server does not need to support WebDAV, be sure to disable it or disallow unnecessary HTTP methods. Introduction to the method:In addition to the standard get and post methods, HTTP requests use a variety of other methods. Many of these methods are mainly used to accomplish uncommon and special tasks. If these methods are accessible to low-privileged users, they can then implement effective attacks against the application. Here are some notable ways to do this:

PUT	Uploading files to a specified directory
DELETE	Delete the specified resource
COPY	Copies the specified resource to the location specified by the destination message header
MOVE	Moves the specified resource to the location specified by the destination message header
SEARCH	Search for resources in a directory path
PROPFIND	Gets information about the specified resource, such as author, size, and content type
TRACE	Returns the original request received by the server in the response

Several of these methods belong to the HTTP protocol WebDAV (web-based distributed Authoring and Versioning) extension. penetration test steps:Use the Options method to list the HTTP methods used by the server. Note that the methods that are activated in different directories may vary. Many times, it is advised that some methods are effective, but they are not actually used. Sometimes, even if a method is not listed in the response returned by the options request, the method is still available. Test each method manually to verify that it is available. To test with Curl:

Curl -v -X OPTIONS http://www.example.com/test/

View the allow:get of the response, HEAD, POST,PUT,DELETE, OPTIONS

Curl -v -T test. HTML http://www.example.com/test/test.html

See if it can be uploaded to determine if the attack takes effect. Find a page that exists, such as test2.html

Curl -X DELETE http://www.example.com/test/test2.html

If the deletion succeeds, the attack is valid. Solution:such as Tomcat, configure Web. xml

<security-constraint>
<web-resource-collection>
<web-resource-name>Fortune</web-resource-name>
<url-pattern>/*</url-pattern>
PUT DELETE</HTTP-METHOD>
head</HTTP-METHOD>
< Http-method>options</HTTP-METHOD>
trace</HTTP-METHOD>
</WEB-RESOURCE-COLLECTION>
</SECURITY-CONSTRAINT>
<LOGIN-CONFIG>
<auth-method> basic</AUTH-METHOD>
</login-config>

Reboot tomcat to complete. The above code is added to an application and can also be added to the Tomcat Web. XML, except that adding to an app is only valid for one app, and if added to the Tomcat Web. XML, it is valid for all apps under Tomcat.

Unsecured HTTP method is enabled