Lately, I've noticed that many web server configurations reflect the method of an HTTP request sent with a non implemented method in the body of the server's response.
For example, A request sent with the method GETTT will be responded with a 501 "method not implemented" response code, while the body of the response announces that the method "GETTT" is not supported. From what I understand, this means that if the method sent to the web server is not properly validated it can be vulnerable to a reflected XSS attack.
My question is, how can an attacker take advantage of this type of situation to create a link that will cause an HTTP request to be issued with an arbitrary method containing XSS payload? In theory, jquery $ajax requests should be able to handle this type of issue, as also stated in the following discussion - https://stackoverflow.com/questions/20425594/sending-an-http-request-with-an-unordinary-method/
I was able to send these type of requests several months ago (In Internet Explorer), but for some reason, jquery $ajax does do the trick for me anymore.
I'm sure this is a solvable issue and just a matter of finding the right payload, does anyone have any suggestions?
!
,#
,$
,%
,&
,'
,*
,+
,-
,.
,0
–9
,@
,A
–Z
,^
,`,
_,
a–
z, and
~)](http://tools.ietf.org/html/rfc2616#section-5.1.1). But I think it’s even more restricted, like, to only uppercase
A–
Z` and-
.@
.