Skip to content

Insecure HTTP Methods

One Liner

  • Checking HTTP Methods
curl -i -X OPTIONS http://XXXXnmap --script http-methods --script-args http-methods.url-path='/test' $ipCurl usagecurl -X POST http://internal-01.bart.htb/simple_chat/register.php -d "uname=0xdf&passwd=password"
  • Shell via Put Method
Put Shellcurl -X PUT -T "/path/to/file" ""curl -X MOVE --header  "Destination:http://ip/asp.asp" "http://ip/asp.txt"

HTTP Status Codes

Sr.No.Method and Description


It retrieves information from a server using a given URI. It is essential that GET requests only retrieve data and do not alter it in any way.



Similar to GET, but only transfers the status line and header.



Data is sent to the server using this method. For example, collecting user information, file uploading etc.



By using the PUT method, you're telling the server to store the enclosed entity under the given URI. If the URI refers to an existing resource, it gets modified, and if it doesn't, then the server creates the resource with that URI.



It removes the resource from target source supplied by given URI.



It establishes a tunnel to the server identified by a given URI.



It shows all available methods to communicate with the server.



A HTTP TRACE method is used for diagnostic purposes. It will echo the exact request that was received in its response if the TRACE method is enabled.

How to Exploit

To exploit any methods it is important to know which methods are enabled, for that we can simply check via OPTIONS

If that not worked you should definitely try by submitting random word as method. Sometime you might receive and error which shows which methods are implemented.

Once we got to know which methods are enabled then we will look for exploit respectively.

  • HEAD, GET, POST, and CONNEC are safe HTTP Method. Of course, the request itself may have malicious parameters, but that is separate from the exploiting http Method topic. It is always recommended that disable unnecessary methods.

  • PUT, DELETE - these methods were initially intended as file management operations. Some web servers still support these in their original format. You can change or delete files from the server's file system arbitrarily. If these are enabled, it opens you to perform some dangerous attacks. Here is the great article to exploit PUT method -

  • OPTIONS: As previously mentioned, we can use this method to identify which other methods are enabled so it can be considered a shortcut to finding another hole. Now, this is not a vulnerability; since there is no actual use for it, it just increases the attack surface and should ideally be disabled. Although the OPTIONS method is used for several legitimate purposes nowadays, for example, some REST APIs require an OPTIONS request, CORS requires pre-flight requests, and so on. So there are scenarios wherein OPTIONS should be enabled, but the default should still be "disabled unless required".

  • TRACE - This is also a diagnostic method that returns the entire HTTP Request in the response body. This includes the request body and the request headers, including, e.g. cookies, authorization headers, and more. Not too surprising, this can be substantially misused, such as the classic Cross-Site Tracing (XST) attack, wherein an XSS vector can be utilized to retrieve HttpOnly cookies, authorization headers, and such. This should be disabled.