Timeline for How to exploit HTTP Methods
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 2, 2017 at 13:21 | comment | added | Gewure | @AviD yes sure; i came across this recently doing some testing of our embedded webserver. I have to say i have no idea, how to exploit this, but OWASP lists it as risk and suggests to shut down the method, if not needed: owasp.org/index.php/Test_HTTP_Methods_(OTG-CONFIG-006) | |
| Aug 2, 2017 at 12:50 | comment | added | AviD♦ | @Gewure can you explain? Of course there can be additional vulnerabilities exploitable via a specific method, but that doesn't make the availability of the method an issue...? | |
| Aug 2, 2017 at 11:04 | comment | added | Gewure | @AviD the CONNECT method can be used to exploit the Webserver as a proxy, so i wouln't call that completely safe, since that can be a serious misuse with consequences for the hoster. | |
| Oct 3, 2016 at 21:24 | comment | added | Kyeotic | @AviD You added a note after the options section, but you left this bit in " In reality, this is rarely used nowadays for legitimate purposes." This conflicts with the note you added | |
| Sep 5, 2015 at 23:06 | history | edited | AviD♦ | CC BY-SA 3.0 |
modern usage of OPTIONS
|
| Apr 1, 2014 at 8:31 | comment | added | Dungeon Hunter | OPTIONS is heavily used in new HTML5 security model | |
| Nov 19, 2013 at 19:34 | comment | added | Neil McGuigan | OPTIONS is heavily used nowadays for REST APIs | |
| Oct 11, 2012 at 14:24 | vote | accept | Digital fire | ||
| Oct 10, 2012 at 23:48 | history | answered | AviD♦ | CC BY-SA 3.0 |