Re: HTTP GETs with a PUT

[anthony kasza <anthony.kasza () gmail com>]

What's the HTTP server software you're running this against?

-AK
On Oct 28, 2012 10:38 AM, "Robin Wood" <robin () digininja org> wrote:

> I've just been tidying up my tools and found a script which checks
> which HTTP methods are enabled on a given site. I ran it against my
> site and it said PUT is enabled. I know that it isn't so I manually
> tested it and proved it wasn't enabled. I checked what it was actually
> sending and it was trying to PUT to / so I tried that and got a 200
> back along with the content of my index page. I tried again with
> another page and got the content of that page.
>
> So for some reason PUT is acting as a GET for pages which exist, I
> checked OPTIONS and that is doing the same both of them only work with
> HTTP 1.1, not 1.0.
>
> I've tried a few sites, apache.org, pauldotcom.com and microsoft.com
> all fail but php.net gives back the content.
>
> nc php.net 80
> PUT / HTTP/1.1
> Host: php.net
>
> HTTP/1.1 200 OK
> Date: Sun, 28 Oct 2012 15:30:30 GMT
> .
> .
> .
>
>
> If this common it might be a nice way to bypass IDS that are looking
> for GET or HEAD methods or to bypass restrictions which lock out those
> two methods.
>
> Comments?
>
> Robin
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom () mail pauldotcom com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com
_______________________________________________
Pauldotcom mailing list
Pauldotcom () mail pauldotcom com
http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
Main Web Site: http://pauldotcom.com