First, why is HTTP TRACE method allowed on a website Isn't it a bad thing for web server or its users' security?

Second, when I run the following PHP script via my browser...


$service_port = getservbyname('www', 'tcp');


$address = gethostbyname($host);

$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);

if ($socket < 0) echo "socket_create() failed: reason: " . socket_strerror($socket) . "\n";

$result = socket_connect($socket, $address, $service_port);

if ($result < 0) echo "socket_connect() failed.\nReason: ($result) " . socket_strerror($result) . "\n";

$in = "TRACE /t.php HTTP/1.1\r\n";
$in .= "Cookie: x=str<script>alert(\"XSS\");</script>str\r\n";
$in .= "Host: $host\r\n";
$in .= "Connection: Close\r\n\r\n";

$out = '';

socket_write($socket, $in, strlen($in));

while ($out = socket_read($socket, 2048)) {
    echo $out;



...I get a javascript alert window with my message (XSS) that is in the request cookie header, and some other headers/info are displayed within the browser window. Isn't this the sign of a particular vulnerability with this website? I mean things such as XSS, XST, etc. vulnerabilities.

  • Well that would be some little security thing but there are other security measures on this website too. And it would require certain code to actually exploit this. I dont host anything which could be abused this way, but I got TRACE disabled on all servers anyway. Commented Jun 29, 2012 at 19:10
  • Regarding "what should I do": For any suspected vulnerability, you should contact the site's owner - not post it on a third-party, public forum.
    – Iszi
    Commented Jun 29, 2012 at 19:19
  • I have just assured IPS snort rule for this **** Commented Jun 29, 2012 at 19:44
  • "I have just assured IPS snort rule for this ****" @Andrew, Please clarify this sentence. I don't understand it. Commented Jun 29, 2012 at 19:57
  • Please do not post domain names in questions here - as Iszi and Andrew pointed out it is not a good idea!
    – Rory Alsop
    Commented Jun 29, 2012 at 20:05

2 Answers 2


The alert box is displayed because your PHP script is using ...

echo $out;

... without escaping $out. The JavaScript is executed on your domain. Whether the PHP script connects to another server, or just writes the unescaped script tag directly, does make no difference.

In order to exploit a TRACE vulnerability, you need to trick the browser to send a TRACE request, for example via JavaScript, Flash, Active X.

The common motivation to exploit TRACE is to read information from the request header that is otherwise unavailable (such as httpOnly cookies and authentication headers):

var request = new ActiveXObject(“Microsoft.XMLHTTP”);
request.open("TRACE", "http://example.com", false);

HTTP Trace is a debugging tool which can be used for malicious use but it does not indicate the presence or lack of XSS or XST, which may or may not be present through other vulnerabilities.

Additionally, if you run code like that on a domain you do not have permissions, you may fall foul of legislation such as the Computer Misuse Act in the UK and may be tried in a criminal court.

My advice would be not to try this on any real website you do not own - see other questions on Security Stack Exchange on running your own vulnerable test servers if you need to find out more.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .