I was reading a paper about 'HTTP Verb Tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html

The author said:

2) HTTP Verb tampering is generally used in conjunction with syntactic (XSS, SQLi, etc.) and semantic (bypass authentication/authorization controls) attacks as way to bypass certain defense measures. Arshan’s work on implementation details focus on the semantic version.

Can anyone give me an example about how we can exploit sql injection and xss via http verb tampering?

I don't understand the next example in the same paper about this.

  • The example simply says to launch the injection attack using another verb other than GET. – schroeder May 7 '19 at 21:12
  • @schroeder , but how it make a different ? i still dont understand , can you explain it to me please ? – Learrn9990 May 7 '19 at 23:07
  • 1
    It explains it: "A config might say HTTP requests to the /admin/* directory using “GET” must have an “admin” session role. One would ASSUME any methods not listed (POST, HEAD, WHATEVER) in the config would automatically be placed in default-deny mode, but this is not necessarily the case." – schroeder May 7 '19 at 23:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.