Test HTTP Methods (OTG-CONFIG-006) - Revision history

Lvsteche at 10:56, 4 November 2015

2015-11-04T10:56:50Z

2014-08-05T14:56:43Z

Reorder Tools heading

2014-08-01T19:19:08Z

Added Andrew's changes.

2014-05-13T21:50:56Z

Final edit

2014-04-01T21:57:25Z

2013-09-04T21:47:33Z

Added curl to tools section

2013-09-04T21:46:43Z

Updated "Bypassing VBAAC with HTTP Verb Tampering" tampering link

2013-07-28T13:21:11Z

Andrew Muller moved page Testing for HTTP Methods and XST (OWASP-CM-008) to Test HTTP Methods (OTG-CONFIG-006): Align with common number and cross-product correlation initiative

2013-03-03T16:12:29Z

Fixed references

2012-10-09T14:44:39Z

@@ Line 61: / Line 61: @@
-As we can see in the example, OPTIONS provides a list of the methods that are supported by the web server, and in this case we can see that TRACE method is enabled. The danger that is posed by this method is illustrated in the following section<br><br>
+As we can see in the example, OPTIONS provides a list of the methods that are supported by the web server, and in this case we can see that TRACE method is enabled. The danger that is posed by this method is illustrated in the following section
 '''Test XST Potential'''<br>
 Note: in order to understand the logic and the goals of this attack one must be familiar with [[XSS |Cross Site Scripting attacks]].
@@ Line 170: / Line 188: @@
 *NetCat - http://nc110.sourceforge.net
 *cURL - http://curl.haxx.se/

@@ Line 27: / Line 27: @@
-== Arbitrary HTTP Methods ==
+=== Arbitrary HTTP Methods ===
 Arshan Dabirsiaghi (see links) discovered that many web application frameworks allowed well chosen or arbitrary HTTP methods to bypass an environment level access control check:
@@ Line 39: / Line 39: @@
-== Black Box Testing ==
+== How to Test ==
 '''Discover the Supported Methods''' <br>
@@ Line 165: / Line 165: @@
 With some luck, using the above three commands - modified to suit the application under test and testing requirements - a new user would be created, a password assigned, and made an administrator, all using blind request submission.
@@ Line 174: / Line 179: @@
 * Amit Klein: "XS(T) attack variants which can, in some cases, eliminate the need for TRACE" - http://www.securityfocus.com/archive/107/308433
 * Arshan Dabirsiaghi: "Bypassing VBAAC with HTTP Verb Tampering" - http://static.swpag.info/download/Bypassing_VBAAC_with_HTTP_Verb_Tampering.pdf

@@ Line 1: / Line 1: @@
 {{Template:OWASP Testing Guide v4}}
-== Brief Summary ==
+== Summary ==
 HTTP offers a number of methods that can be used to perform actions on the web server. Many of theses methods are designed to aid developers in deploying and testing HTTP applications. These HTTP methods can be used for nefarious purposes if the web server is misconfigured. Additionally, Cross Site Tracing (XST), a form of cross site scripting using the server's HTTP TRACE method, is examined.<br>
 While GET and POST are by far the most common methods that are used to access information provided by a web server, the Hypertext Transfer Protocol (HTTP) allows several other (and somewhat less known) methods. RFC  2616 (which describes HTTP version 1.1 which is the standard today) defines the following eight methods:
@@ Line 101: / Line 99: @@
 More detailed information, together with code samples, can be found in the original whitepaper written by Jeremiah Grossman.<br>
@@ Line 171: / Line 165: @@
 With some luck, using the above three commands - modified to suit the application under test and testing requirements - a new user would be created, a password assigned, and made an administrator, all using blind request submission.
@@ Line 186: / Line 176: @@
-'''Tools'''
+==Tools==
 *NetCat - http://nc110.sourceforge.net
 *cURL - http://curl.haxx.se/

@@ Line 42: / Line 42: @@
 The testing method is extremely straightforward and we only need to fire up netcat (or telnet):
 <pre>
-icesurfer@nightblade ~ $ nc www.victim.com 80
+$ nc www.victim.com 80
 OPTIONS / HTTP/1.1
 Host: www.victim.com
@@ Line 53: / Line 53: @@
 Content-Length: 0
 </pre>
 As we can see in the example, OPTIONS provides a list of the methods that are supported by the web server, and in this case we can see, for instance, that TRACE method is enabled. The danger that is posed by this method is illustrated in the following section<br><br>
@@ Line 63: / Line 62: @@
 As mentioned before, TRACE simply returns any string that is sent to the web server. In order to verify its presence (or to double-check the results of the OPTIONS request shown above), we can proceed as shown in the following example:
 <pre>
-icesurfer@nightblade ~ $ nc www.victim.com 80
+$ nc www.victim.com 80
 TRACE / HTTP/1.1
 Host: www.victim.com
@@ Line 95: / Line 94: @@
 <pre>
-[rapidoffenseunit:~] vanderaj% nc www.example.com 80
+$ nc www.example.com 80
 JEFF / HTTP/1.1
 Host: www.example.com
@@ Line 120: / Line 119: @@
 <pre>
-[rapidoffenseunit:~] vanderaj% nc www.example.com 80
+$ nc www.example.com 80
 HEAD /admin HTTP/1.1
 Host: www.example.com

@@ Line 163: / Line 163: @@
 '''Tools'''
 * NetCat - http://nc110.sourceforge.net
-<br>
+*cURL - http://curl.haxx.se/

@@ Line 158: / Line 158: @@
 * Jeremiah Grossman: "Cross Site Tracing (XST)" - http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf<br>
 * Amit Klein: "XS(T) attack variants which can, in some cases, eliminate the need for TRACE" - http://www.securityfocus.com/archive/107/308433
-* Arshan Dabirsiaghi: "Bypassing VBAAC with HTTP Verb Tampering" - http://www.aspectsecurity.com/documents/Bypassing_VBAAC_with_HTTP_Verb_Tampering.pdf
+* Arshan Dabirsiaghi: "Bypassing VBAAC with HTTP Verb Tampering" - http://static.swpag.info/download/Bypassing_VBAAC_with_HTTP_Verb_Tampering.pdf

← Older revision	Revision as of 13:21, 28 July 2013
(No difference)

@@ Line 154: / Line 154: @@
 == References ==
 '''Whitepapers'''<br>
-* RFC 2616: âHypertext Transfer Protocol -- HTTP/1.1â
+* RFC 2616: "Hypertext Transfer Protocol -- HTTP/1.1"
-* RFC 2109 and RFC 2965: âHTTP State Management Mechanismâ
+* RFC 2109 and RFC 2965: "HTTP State Management Mechanism"
 * Jeremiah Grossman: "Cross Site Tracing (XST)" - http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf<br>
 * Amit Klein: "XS(T) attack variants which can, in some cases, eliminate the need for TRACE" - http://www.securityfocus.com/archive/107/308433

← Older revision		Revision as of 14:44, 9 October 2012
Line 1:		Line 1:
−	{{Template:OWASP Testing Guide v3}}	+	{{Template:OWASP Testing Guide v4}}

	== Brief Summary ==		== Brief Summary ==