-3

Here I am new to insecure HTTP Methods Enabled.

The server allows HTTP methods that are considered dangerous. The following methods were enabled: PUT,DELETE

Software used: Apache-tomcat-6.0.29.

  1. How to reproduce the same?
  2. How to fix this problem/issue?

closed as unclear what you're asking by Jens Erat, Steve Dodier-Lazaro, Xander, RoraΖ, schroeder Jun 18 '15 at 16:03

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • May have a look at: stackoverflow.com/questions/320959/… or for whitelist: serverfault.com/questions/662548/… – Danny. Jun 18 '15 at 6:23
  • how to reproduce this HTTP Methods Enabled or not. @danny – Ramakrishnan M Jun 18 '15 at 6:58
  • 2
    What do you want to reproduce? Do you want to test the HTTP Methods? Then simply create an HTTP Request (Tools on internet or have a look at the posted questions). Would be great if you show a bit more effort (Improve Quality of your question, make clear what you want). Otherwhise the community will not give you enough attention. – Danny. Jun 18 '15 at 7:00
  • 1
    In case you use (FULL) REST API's, the PUT and DELETE methods should be enabled. It's recommended to only have these method enabled at a specific endpoint such as http://..../api/ – Jeroen Jun 18 '15 at 10:42
3
  1. How to reproduce the same?

There are multiple answers on this site for exactly that question. Typing HTTP method into the Search box pulls up:

  1. How to fix this problem issue?

Under Tomcat, you can disable specific methods via the web.xml configuration file:

 <security-constraint>
 <web-resource-collection>
  <web-resource-name><strong>restricted methods</strong></web-resource-name>
  <url-pattern>/*</url-pattern>
  <http-method>PUT</http-method>
  <http-method>POST</http-method>
  <http-method>DELETE</http-method>
  <http-method>OPTIONS</http-method>
  <http-method>TRACE</http-method>
 </web-resource-collection>
 <auth-constraint />
 </security-constraint>

As @Danny points out in the comments, you may want a whitelist rather than a blacklist, and here's a Tomcat 7 example. Here's an alternative for Tomcat 6.

That being said, a blacklist is often sufficient for HTTP methods because:

  • There's a reasonably static/unchanging list of what's supported,
  • Unsupported methods are generally quietly dropped by any competent web server

That said, if the report of Tomcat being case sensitive is true, a whitelist would be the appropriate way to compensate for crappy software.

  • Well, from Security point of view he should do "whitelisting" not "blacklisting". Disable everything and only allows "accepted" methods like: serverfault.com/questions/662548/… . – Danny. Jun 18 '15 at 10:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.