0

I'm trying to test if it's possible to use the PUT method to upload content to a IIS 5.0 server. The WebDav is actualy enabled and the PUT method is allowed for public/internet users:

OPTIONS /website HTTP/1.1
Host: www.targetiis.com

HTTP/1.1 200 OK
Date: Fri, 03 Oct 2014 10:18:02 GMT
Server: Microsoft-IIS/5.0
X-Powered-By: ASP.NET
MS-Author-Via: DAV
Content-Length: 0
Accept-Ranges: none
DASL: <DAV:sql>
DAV: 1, 2
Public: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
Allow: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK
Cache-Control: private
Content-Type: text/plain

But when I use the PUT method I get an error message :

PUT /website/file.txt HTTP/1.1 
Host: www.targetiis.com 
Content-Length: 29

<%response.write("hello")%>

HTTP/1.1 403 Forbidden 
Date: Fri, 03 Oct 2014 10:26:55 GMT 
Server: Microsoft-IIS/5.0 X-Powered-By: ASP.NET 
Content-Type: text/html 
Content-Length: 4096

So what is the possible reason for this response ?

1

HTTP status status message 403 means the client doesn't have the access rights, that's why you are getting this response. HTTP PUT methods requires authorization to give access to the server content. Since PUT is dangerous method, if proper security mechanism is not used to restrict the users. So if you want to put some content on the server so you must use Authorization, for authorization you need to know the credentials, that you might not know because you are not a administrator. The HTTP header with authorization is,

PUT /website/file.txt HTTP/1.1

Authorization = "Authorization" ":" credentials

Host: www.targetiis.com

Content-Length: 29

  • Yes but if you the "Public" header lists those requests which "anyone" may use. – TMR_OS Oct 3 '14 at 10:53
  • Public: <methods> means methods available at the server and Allow: <methods> means the allowed method at this server. – P4cK3tHuNt3R Oct 3 '14 at 11:07
  • So anyone can use the allowed method only not the available. – P4cK3tHuNt3R Oct 3 '14 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.