Http Trace Enabled
Description
Detects when the HTTP TRACE method is enabled on the server, allowing cross-site tracing attacks where an attacker can read sensitive HTTP headers (e.g. cookies, auth tokens) set by the browser.
Detection Strategy
• Sends an HTTP TRACE request to the target URL with redirect following disabled
• Reports a vulnerability if the server responds with HTTP 200 and the body starts with 'TRACE /' (the reflected request line begins at byte 0, ruling out pages that merely mention TRACE in their content)
• A non-200 status code or a body that does not start with 'TRACE /' indicates the method is disabled or filtered
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' pentesting team, fill out this contact form.