Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

First, why is HTTP TRACE method allowed on a website Isn't it a bad thing for web server or its users' security?

Second, when I run the following PHP script via my browser...

<?php

$service_port = getservbyname('www', 'tcp');

$host='vulnerabledomain.org';

$address = gethostbyname($host);

$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);

if ($socket < 0) echo "socket_create() failed: reason: " . socket_strerror($socket) . "\n";

$result = socket_connect($socket, $address, $service_port);

if ($result < 0) echo "socket_connect() failed.\nReason: ($result) " . socket_strerror($result) . "\n";

$in = "TRACE /t.php HTTP/1.1\r\n";
$in .= "Cookie: x=str<script>alert(\"XSS\");</script>str\r\n";
$in .= "Host: $host\r\n";
$in .= "Connection: Close\r\n\r\n";

$out = '';

socket_write($socket, $in, strlen($in));

while ($out = socket_read($socket, 2048)) {
    echo $out;
}

socket_close($socket);

?>

...I get a javascript alert window with my message (XSS) that is in the request cookie header, and some other headers/info are displayed within the browser window. Isn't this the sign of a particular vulnerability with this website? I mean things such as XSS, XST, etc. vulnerabilities.

share|improve this question
    
Well that would be some little security thing but there are other security measures on this website too. And it would require certain code to actually exploit this. I dont host anything which could be abused this way, but I got TRACE disabled on all servers anyway. –  Andrew Smith Jun 29 '12 at 19:10
    
Regarding "what should I do": For any suspected vulnerability, you should contact the site's owner - not post it on a third-party, public forum. –  Iszi Jun 29 '12 at 19:19
    
I have just assured IPS snort rule for this **** –  Andrew Smith Jun 29 '12 at 19:44
    
"I have just assured IPS snort rule for this ****" @Andrew, Please clarify this sentence. I don't understand it. –  George Bailey Jun 29 '12 at 19:57
    
Please do not post domain names in questions here - as Iszi and Andrew pointed out it is not a good idea! –  Rory Alsop Jun 29 '12 at 20:05

2 Answers 2

HTTP Trace is a debugging tool which can be used for malicious use but it does not indicate the presence or lack of XSS or XST, which may or may not be present through other vulnerabilities.

Additionally, if you run code like that on a domain you do not have permissions, you may fall foul of legislation such as the Computer Misuse Act in the UK and may be tried in a criminal court.

My advice would be not to try this on any real website you do not own - see other questions on Security Stack Exchange on running your own vulnerable test servers if you need to find out more.

share|improve this answer
    
$ grep <access.log TRACE | mail abuse@cyber-police.co.uk :-) –  Andrew Smith Jun 29 '12 at 19:21

The alert box is displayed because your PHP script is using ...

echo $out;

... without escaping $out. The JavaScript is executed on your domain. Whether the PHP script connects to another server, or just writes the unescaped script tag directly, does make no difference.


In order to exploit a TRACE vulnerability, you need to trick the browser to send a TRACE request, for example via JavaScript, Flash, Active X.

The common motivation to exploit TRACE is to read information from the request header that is otherwise unavailable (such as httpOnly cookies and authentication headers):

var request = new ActiveXObject(“Microsoft.XMLHTTP”);
request.open("TRACE", "http://example.com", false);
request.send();
alert(request.responseText);
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.