What attacker will benefit of TRACE Exploitation and What is the Recommendation to fix this issue?
2
-
Duplicated: security.stackexchange.com/questions/56955/…, security.stackexchange.com/questions/7703/…, security.stackexchange.com/questions/16676/…– kinuntDec 9, 2014 at 6:11
-
Please refrain from asking anymore questions as long as you have not read our FaQ and help pages.– Lucas KauffmanDec 9, 2014 at 7:21
Add a comment
|
1 Answer
Anything sent in a request using the HTTP TRACE method will be echo-ed back in the response.
This may lead to Cross Site Tracing (XST) attacks, which could lead to steal a user's cookie even if the cookie has the HTTPOnly attribute flag set.
The HTTP TRACE method is used for debugging purposes only and should be disabled.
Apache Configuration:
TraceEnable off
IIS Registry Setting:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters
EnableTraceMethod: 0
