The HTTP protocol
has a bunch of methods used for interacting with the web server. Most people
only know of the POST (parameters values are hidden in the HTTP request) and
GET (parameter values can be seen in the URL) methods. However, there are 6 more methods in existence. These include
HEAD, PUT, DELETE, TRACE, OPTIONS,
& CONNECT.
The PUT (allows
clients to upload files), DELETE (allows client to delete files) , CONNCT
(allows clients to use the web server as a proxy server to connect to other
servers) and TRACE methods should be
disabled by all web servers unless it is specially needed.
For a hacker to take
advantage of this, he or she must first know which methods the server supports.
OWASP Testing guide states that this can be done through a program called
NETCAT . Once this program is downloaded and installed, one simply has to run the
following command: nc -v www.domain.com
80. Unfourenelty, this method did not
work for me and I kept running into the following error.
DNS fwd/rev mismatch: www.domain.com hostname.domain.com
www.domain.com [xxx.xxx.xxx.xx] xx (http) open.
The next couple of
days, one of my goals will be to try to get this this working since it seems
like a valuable tool. Lastly, the guide
provides more information on cross site scripting using the TRACE method, but due
to the NETCAT not cooperating with my computer,
trying this out will have to wait a few days.
