Penetration Test-http method

In addition to the HTTP transmission, in addition to the regular get, post methods, there are another 6 methods, as follows (get and post general method is not described):

PUT: This method allows the client to upload a new file on the Web Server. An attacker could use this method to upload a malicious file (for example, an ASP file that executes a command by calling Cmd.exe).

Delete: This method allows the client to delete files on the Web Server.

CONNECT: This method allows the client to use the Web server as a proxy.

TRACE: This method simply returns these to the client, regardless of the character sent to the Server. Can be used for cross-site tracing attacks.

Test method:

1. Use NC (Netcat) to send options to see which methods are supported on the target site:
   

NC www.targetweb.com 80

options/http/1.1

Host:www.targetweb.com

http/1.1 OK
server:microsoft-iis/5.0
date:tue, OCT 2006 08:00:29 GMT
Connection:close
allow:get, HEAD, POST, TRACE, OPTIONS (scrambled data, but normal will return These)

This article is from the "boundless" blog, please make sure to keep this source http://7492110.blog.51cto.com/7482110/1862674

Penetration Test-http method