TRACE method is enabled

Description

During the scan, Kayran managed to find that the TRACE method is enabled.
The TRACE method is intended to help developers in debugging.
If the TRACE method is enabled, the web server will “echo” the requests using the TRACE method in its responses with the exact request it received.

An attacker can use this information which will assist him/her in conducting further, more advanced attacks against your assets.

Severity/Score

Average Score – 5.3 Medium

Recommendation

Disable the TRACE method to avoid attackers using it, and through that, better exploiting other vulnerabilities.

References

https://owasp.org/www-community/attacks/Cross_Site_Tracing

https://cwe.mitre.org/data/definitions/16

https://cwe.mitre.org/data/definitions/489.html

< Return to all Vulnerabilities

Crossing Scripts – XSS

Injections. SQL Injections. Cross-site Scripting (hence the amazing title “Crossing Scripts – XSS”). There all sorts of Injection-Based attacks, if you want to read about

Read More »

Blue Team

We’ve talked about The Red Team before, but what about The Blue Team? How is this group different from the red one? Why would we

Read More »

The Dark Web

Let’s talk about the darker and more mysterious side of the internet, also known as The Dark Web. You’ve probably heard about it, whether it’s

Read More »