159
HTTP DELETE method support detection
HTTP
2004/09/07
Marc Ruef
marc dot ruef at computec dot ch
http://www.computec.ch
computec.ch
Marc Ruef
marc dot ruef at computec dot ch
http://www.computec.ch
computec.ch
2004/11/14
2.0
Corrected the plugin structure and added the accuracy values in 1.1. Improved the pattern matching and introduced the plugin changelog in 2.0
tcp
80
open|send OPTIONS * HTTP/1.0\n\n|sleep|close|pattern_exists HTTP/#.# ### *Allow:*DELETE*
98
This plugin was written with the ATK Attack Editor.
Nearly every http web server
Specialized and hardened web servers
Configuration
In the World Wide Web (WWW) the Hyper Text Transport Protocol (HTTP) is used to transfer the main data. It is client/server based and HTTP requests are used to get the requested data. There is a method named DELETE which let delete a ressource on a web server.
A service if not needed should be de-installed or disabled. If this is not possible, an access control list (ACL) with firewalling should be applied to this port. Do not allow not needed methods as like DELETE, TRACE or TRACK.
Approx. 1 hour
Yes
Yes
Yes
Low
6
8
7
6
Hacking Exposed: Network Security Secrets & Solutions, Stuart McClure, Joel Scambray and George Kurtz, February 25, 2003, 4th Edition, McGraw-Hill Osborne Media, ISBN 0072227427
http://www.cse.ohio-state.edu/cgi-bin/rfc/rfc2616.html
