Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How can I test for HTTP TRACE on my web-server?

I need to train a Tester how to verify that the HTTP TRACE method is disabled.

Ideally I need a script to paste into Firebug to initiate a https connection to return the web server response to a HTTP TRACE command.

Background:

Our security Pen Testers identified a HTTP TRACE vulerability and we need to prove that it is fixed.

References:

share|improve this question

5 Answers 5

up vote 14 down vote accepted

Simplest way I can think of is using cURL (which is scriptable).

 curl -v -X TRACE http://www.yourserver.com

Running it against an Apache server with TraceEnable Off correctly returns HTTP/1.1 405 Method Not Allowed (just tested on an Apache 2.2.22)

This also works on HTTPS sites, provided that cURL has the correct information supplied to the SSL layer. This is the lazy man's check of Google

curl --insecure -v -X TRACE https://www.google.com/

...it negotiates the connection (does not verify the certificate chain, but that's not the issue here since we want to check on TRACE status), and responds 405:

* Server certificate:
*        subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=www.google.com
*        start date: 2013-02-20 13:34:56 GMT
*        expire date: 2013-06-07 19:43:27 GMT
*        subjectAltName: www.google.com matched
*        issuer: C=US; O=Google Inc; CN=Google Internet Authority
*        SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
> TRACE / HTTP/1.1
> User-Agent: curl/7.25.0 (x86_64-suse-linux-gnu) libcurl/7.25.0 OpenSSL/1.0.1c zlib/1.2.7 libidn/1.25 libssh2/1.4.0
> Host: www.google.com
> Accept: */*

< HTTP/1.1 405 Method Not Allowed
share|improve this answer
    
While probably being the simplest solution over plain HTTP, this doesn't work over HTTPS. –  Gurzo Feb 28 '13 at 6:02
    
I've tried with Google (trace disabled) and another server (trace enabled) and it seems to work to me. Updating answer... –  lserni Feb 28 '13 at 9:59
    
Thanks everyone for the great answers, but this answer was the most user friendly of the lot. –  Andrew Russell Mar 1 '13 at 1:21
    
Just what I was looking for - Thanks! –  Justin Ethier Jun 24 at 13:22

There are two ways:

STEP 1: openssl s_client -connect example.com:443

STEP2 :

TRACE / HTTP/1.1
host: example.com

(press enter twice)

or

OPTIONS / HTTP/1.1
host: example.com

(press enter twice) (you might need to paste these rapidly so copy paste them rather by typing out) STEP 3: Verify if the output, it should give error 400 if I'm not mistaking.

Another tool you can use is gnutls.

share|improve this answer
1  
If they aren't using HTTPS, you can replace your step 1 (openssl s_client -connect example.com:443) with telnet example.com 80. –  dr jimbob Feb 28 '13 at 1:41

You could use a proxy, like Burp Suite or Zap, and follow some simple steps:

  1. set up your browser to pass through the chosen proxy;
  2. make a normal HTTP request (e.g. GET /index.php HTTP/1.1) and intercept it;
  3. change the HTTP method to TRACE and send the request to the server;
  4. check the HTTP response.

If the response includes the whole request, then TRACE is enabled and working properly.

share|improve this answer

What everyone else said was accurate as far as sending the test however no one has given a correct identification for whether it's vulnerable. Different servers will respond differently, not to mention any mod rewrites on a TRACE/TRACK request. There are two ways of identifying both the TRACE and TRACK vulnerabilities which seem to work without giving false positives or false negatives (that i've been made aware of).

1) The target returns any status code < 400 or >= 600

2) The target returns the headers which you passed in.

share|improve this answer

I appreciate all the great answers provided by the skilled users of the website. I saw your questions reference and you mentioned about OWASP. I'm considering you are familar with the use of owasp and esp owasp live cd.

CAL9000. The tool has a http request field actually its more then a field its allow the custom generation of entire http header. You can select trace define the header options and simply click go. The response would be seen in the text below.

The reason I would recommend this tool more then the other, is this tool is provided by a community which is more reversed in concepts of application security then any other. These tools are tested and verified by experts. More info owasp ref

ALTERNATE METHOD

http://yehg.net/pentest/CAL9000/#httpRequests

its an online version of the tool.

NOTE ON TRACE

Firefox does not currently support the TRACE function (via xmlHttpRequest). CAL9000 gets the TRACE info from a server-side script. Also, a reminder that any request directed at a resource (http://www.blah.com/index.html) is not necessarily going to generate the same response as one directed at a directory (http://www.blah.com/js/), even though they are on the same site.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.