-2

What attacker will benefit of TRACE Exploitation and What is the Recommendation to fix this issue?

2

1 Answer 1

1

Anything sent in a request using the HTTP TRACE method will be echo-ed back in the response.

This may lead to Cross Site Tracing (XST) attacks, which could lead to steal a user's cookie even if the cookie has the HTTPOnly attribute flag set.

The HTTP TRACE method is used for debugging purposes only and should be disabled.

Apache Configuration:

TraceEnable off

IIS Registry Setting:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters
EnableTraceMethod: 0

Not the answer you're looking for? Browse other questions tagged or ask your own question.