This step in the OWASP Testing Guide (v4) shows how to do this in detail using the original netcat:
$ nc www.victim.com 80
OPTIONS / HTTP/1.1
HTTP/1.1 200 OK
This relies on the server supporting
OPTIONS, and reporting back the supported list — this is not always the case (as you're about to find out), but should work fine with an unhardened Apache. One could incorrectly "harden" a web server by removing the
OPTIONS method and nothing else, and most scanners won't notice the problem.
You could also use GNU
netcat (old and unmaintained now), or better still nmap's
ncat which supports SSL/TLS:
ncat --ssl www.victim.com 443 .
It's also possible to use the
nmap http-methods script, but this is really only useful for testing beforehand (since it refuses to proceed if
OPTIONS does not provide a list of methods):
nmap -vvv --script=http-methods.nse \
--script-args http-methods.retest=1 -p 80,443 www.victim.com
Since you are using Apache httpd (included with XAMPP), as an alternative to
mod_rewrite you can also use the core
LimitExcept directive to provide similar filtering of request methods. Note that disabling
TRACE may make the HTTP server non-compliant with the specification (though you should be OK if you return either "405 Method Not Allowed" as you are doing, or "501 Not Implemented").
HEAD are the only two mandatory request methods for a "general-purpose" server.
If you have perl with lwp, and the
GET command is installed you can enumerate
these yourself without relying on
OPTIONS at all:
for mm in GET HEAD PUT POST DELETE OPTIONS PATCH TRACK TRACE PATCH; do
GET -USf -m $mm http://www.victim.com/does/not/exist/OTQ4NzEzMzgxNTg3NzE3NTg1MzA2MzkK
You'll need to inspect the HTTP code for each, 405 and 406 are indicators of a method not being permitted.
The above method list is incomplete, WebDAV adds many more methods, and see also the IANA HTTP method registry (there are proprietary ones too, there was at least one
X-MS- prefixed method in old versions of MS-Exchange).
Finally, there's a useful online tool which remotely scans your web site, and produces a detailed report here: http://www.askapache.com/online-tools/request-method-scanner/ . This too only uses the