XST is a well known vulnerability and the reason that everyone always alerts: TRACE is allowed this is bad. But what I see often at clients is that a request using TRACE returns the same as a GET. Am I doing something wrong, or is this a common thing?

  • 1
    It's not uncommon to find servers which ignore the http verb and treat everything as a get request. I suspect this isn't quite following the spec, but it does happen – Matthew Oct 24 '18 at 19:56
  • Ok, well guess that might be what they do. Just ignore everything but GET and POST. Thanks for the reply, it's sometimes difficult to know when you miss something or when something is just different from expected. You can just set this as answer, I'll accept if no one comes with a "NO it is not true" answer. – Wealot Oct 25 '18 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.