Verify that the insecure HTTP method is enabled. Verify that the http method is enabled.

Verify that the insecure HTTP method is enabled. Verify that the http method is enabled.
Verify that insecure HTTP methods are enabled

Verify that insecure HTTP methods are enabled. Security Risks may cause revision suggestions method overview penetration test procedure use curl test use website monitoring Solution

Security risks:

Web pages, scripts, and files may be uploaded, modified, or deleted on the Web server.

Possible causes:

Web servers or application servers are configured in insecure mode.

Revision suggestions:

If the server does not need to support WebDAV, disable it or disable unnecessary HTTP methods.

Method Introduction:

In addition to the standard GET and POST methods, HTTP requests also use other methods. Many of these methods are mainly used to complete uncommon and special tasks. If low-Permission users can access these methods, they can launch effective attacks to the application. The following are some noteworthy methods:

Method	Function
PUT	Upload files to a specified directory
DELETE	Deletes a specified resource.
COPY	Copy the specified resource to the location specified by the Destination Message Header
MOVE	Move the specified resource to the location specified by the Destination Message Header
SEARCH	Search for resources in a directory path
PROPFIND	Obtains information related to a specified resource, such as the author, size, and content type.
TRACE	Return the original request received by the server in the response.

Several Methods belong to the HTTP protocolWebDAV(Web-based Distributed Authoring and Versioning) extension.

Penetration test procedure:

Use the OPTIONS method to list the HTTP methods used by the server. Note that the activation methods in different directories may be different.
Many times, some methods are told to be valid, but they are not actually usable. Sometimes, this method is still available even if no method is listed in the response returned by the OPTIONS request.
Manually test each method to check whether it is available.

Test with curl:

 
  
   
    fortune
   
   
    /*
   
   
    PUT
   
   
    DELETE
   
   
    HEAD
   
   
    OPTIONS
   
   
    TRACE
   
  
 
 
  BASIC
 

Restart tomcat.
** The above Code can be added to an application or to the tomcat web. in xml, the difference is that adding to an application is only valid for one application. in xml,
It is valid for all applications under tomcat. **