By using nc or curl I get HTTP status code 405 for TRACE requests, but if I scan my site with NMAP, it seems that TRACE is enabled. Could someone explain to me if TRACE is correctly disabled or not?
nc hd1.aon.it 443 TRACE /js/jquery.cookie.js?param=1 HTTP/1.1 Host: hd1.aon.it X-Wind: custom HTTP/1.1 405 Method Not Allowed Content-Length: 83 Content-Type: text/html Date: Thu, 12 Jan 2017 12:59:04 GMT Via: HTTP/1.1 sophos.http.proxy:3128 Connection: keep-alive Error405 - Method Not Allowed
nmap -p 443 --script http-methods hd1.aon.it Starting Nmap 6.46 ( http://nmap.org ) at 2017-01-12 13:41 CET Nmap scan report for hd1.aon.it (188.8.131.52) Host is up (0.00026s latency). rDNS record for 184.108.40.206: 93-63-129-73.ip27.fastwebnet.it PORT STATE SERVICE 443/tcp open https | http-methods: GET HEAD POST TRACE OPTIONS | Potentially risky methods: TRACE |_See http://nmap.org/nsedoc/scripts/http-methods.html Nmap done: 1 IP address (1 host up) scanned in 2.19 seconds