How to disable TRACE by enabling TRACE Method on the server

Time detected:
020 vulnerability type: Other
020 website creation program: Other
Server type of 020: Common
020 programming language: Other
020 description: TRACK Method is enabled on the target WEB server.

1. TRACK_Method is a non-standard protocol debugging method defined by some WEB servers.

2. because this method returns any data submitted by the client as it is, it can be used for cross-site scripting (XSS) attacks, also known as cross-site tracking attacks (XST ).

020 hazards:

1. Malicious attackers can learn some information about the website's front-end, such as the cache server, through the information returned by the TRACK Method to facilitate the next attack.

2. Attackers can use the TRACK Method to perform XSS attacks.
3. Even if the website enables HttpOnly header flag and prevents scripts from reading cookie information for key pages, malicious attackers can bypass this restriction to read cookie information through TRACE Method.

020 solution:

1) If you are using Apache:
-Confirm that the rewrite module is activated (httpd. conf, which is not in front #):

The code is as follows:	Copy code
LoadModule rewrite_module modules/mod_rewrite.so

-Add the following statement to the configuration file of each VM:

The code is as follows:	Copy code
RewriteEngine on RewriteCond % {REQUEST_METHOD} ^ TRACK RewriteRule. *-[F]

Note: You can search for VirtualHost in httpd. conf to determine the configuration file of the VM.