HTTP Method Enumeration

Inspecting the Web Application

The home page contains two additional links that can be explored: Login and Blog. The Login link redirects to login.php, while the Blog link redirects to post.php.

Step 1: Follow the Login Link

Click the Login link or navigate to:

http://demo.ine.local/login.php

The page displays a login form, which will be useful for further web application and HTTP method enumeration.

Step 2: Identify the Form Processing Endpoint

Right-click on the login page and select View Page Source to inspect how the login form is implemented.

From the form source, we can see that the username and password parameters are submitted using a POST request to the same login.php endpoint.

This identifies login.php as the endpoint responsible for processing the login form.

Step 3: Login to the Web Application

Use the provided credentials to log in:

Username: john
Password: password

Username: john
Password: password

After successful authentication, the Login link is replaced with a "Welcome John" message, confirming that the login was successful.

Step 4: Explore the Remaining Link

Click the Blog link to inspect the other available page.

The web application contains the following accessible PHP pages:

• index.php
• login.php
• post.php

Identify Hidden Directories Using DIRB

Next, use DIRB to discover additional directories on the web server.

Command:

dirb http://demo.ine.local

dirb http://demo.ine.local

The scan identifies the following directories:

• css
• img
• js
• mail
• uploads
• vendor

This provides a better understanding of the application's available resources before proceeding with HTTP method enumeration.

Interacting with the Home Page Using cURL

Step 1: Send a GET Request

Use cURL to send a GET request to the target's home page:

Command:

curl -X GET http://demo.ine.local

curl -X GET http://demo.ine.local

The GET request retrieves the content of the web application's home page and allows us to inspect how the server responds to the request.

Step 2: Send a HEAD Request

Use cURL to send a HEAD request to the target:

Command:

curl -I http://demo.ine.local

curl -I http://demo.ine.local

The HEAD request retrieves only the HTTP response headers without the response body. This can reveal information such as the HTTP status code, server type, and supported response headers.

Step 3: Send an OPTIONS Request

Use cURL to send an OPTIONS request and inspect the server's response:

Command:

curl -X OPTIONS http://demo.ine.local -v

curl -X OPTIONS http://demo.ine.local -v

The response indicates that the server supports the following HTTP methods:

• GET
• HEAD
• OPTIONS

This confirms that HTTP method enumeration can be performed using the OPTIONS request. Methods not supported by the server may return an error when accessed.

Step 4: Send a POST Request

Use cURL to test whether the server accepts the POST method:

Command:

curl -X POST http://demo.ine.local

curl -X POST http://demo.ine.local

The server response can be used to determine whether the POST method is supported for the requested resource. If the method is not allowed, the server should return an appropriate HTTP error response such as 405 Method Not Allowed.

Step 5: Send a PUT Request

Use cURL to test whether the server accepts the PUT HTTP method:

Command:

curl -X PUT http://demo.ine.local

curl -X PUT http://demo.ine.local

The server's response indicates whether the PUT method is supported for the requested resource. If it is not supported, the server will typically return an error such as 405 Method Not Allowed.

Interacting with login.php Using cURL

Step 1: Send an OPTIONS Request

Use cURL to identify the HTTP methods supported by the login.php endpoint:

Command:

curl -X OPTIONS http://demo.ine.local/login.php -v

curl -X OPTIONS http://demo.ine.local/login.php -v

The server response indicates that the following methods are allowed:

• GET
• POST
• HEAD
• OPTIONS

This confirms that login.php supports both GET and POST requests, which is expected for a page containing a login form.

Step 2: Send a POST Request

Use cURL to test the POST method on the login.php endpoint:

Command:

curl -X POST http://demo.ine.local/login.php

curl -X POST http://demo.ine.local/login.php

Unlike the home page (index.php), the login.php endpoint accepts POST requests because it processes the login form data.

Step 3: Submit Username and Password

Send the username and password to the login.php endpoint using a POST request:

Command:

curl -X POST http://demo.ine.local/login.php -d "name=john&password=password" -v

curl -X POST http://demo.ine.local/login.php -d "name=john&password=password" -v

The server returns a 302 Found response, indicating that the login request was processed and the server is redirecting the client to another page. This differs from the response received when sending an empty POST request.

Interacting with post.php Using cURL

Step 1: Send an OPTIONS Request

Use cURL to enumerate the HTTP methods supported by the post.php endpoint:

Command:

curl -X OPTIONS http://demo.ine.local/post.php -v

curl -X OPTIONS http://demo.ine.local/post.php -v

The response shows that post.php allows the following HTTP methods:

• GET
• POST
• HEAD
• OPTIONS

This is similar to the login.php endpoint, which supports the same set of HTTP methods.

Interacting with the uploads Directory

Step 1: Check the /uploads Directory

Navigate to the following URL:

http://demo.ine.local/uploads

This allows us to check whether directory listing is enabled and identify any files or resources exposed through the /uploads directory.

Step 2: Send an OPTIONS Request to /uploads

Use cURL to inspect the HTTP methods supported by the /uploads directory:

Commands:

curl -X OPTIONS http://demo.ine.local/uploads/
curl -X OPTIONS http://demo.ine.local/uploads/ -v

curl -X OPTIONS http://demo.ine.local/uploads/
curl -X OPTIONS http://demo.ine.local/uploads/ -v

The response indicates that the WebDAV module is enabled on the Apache server. WebDAV supports file management operations, including uploading files using the PUT HTTP method.

This makes the /uploads directory particularly interesting for further security testing.

Step 3: Upload a File Using the PUT Method

Create a test file containing a simple message:

echo "Hello World" > hello.txt

echo "Hello World" > hello.txt

Upload the file to the /uploads directory using cURL:

curl http://demo.ine.local/uploads/ --upload-file hello.txt

curl http://demo.ine.local/uploads/ --upload-file hello.txt

The --upload-file option sends the file using an HTTP PUT request. If the upload is successful, hello.txt will be stored in the /uploads directory.

Step 4: Verify the Uploaded File

Check the /uploads directory again to verify the upload.

The hello.txt file is now present in the directory, confirming that the server accepts PUT requests and allows files to be uploaded through the WebDAV-enabled /uploads directory.

Step 5: Delete the Uploaded File

Use the DELETE HTTP method to remove the uploaded hello.txt file:

Command:

curl -X DELETE http://demo.ine.local/uploads/hello.txt

curl -X DELETE http://demo.ine.local/uploads/hello.txt

If the request is successful, the server deletes the file from the /uploads directory. This demonstrates that the WebDAV configuration allows file deletion through the DELETE method.

Step 6: Verify File Deletion

Check the /uploads directory again to confirm whether the file was removed.

The hello.txt file is no longer present, confirming that the DELETE method successfully removed the uploaded file.

Interacting with the Web Page Using Burp Suite

Step 1: Configure FoxyProxy

Configure the browser to route traffic through the Burp Suite proxy.

Click the FoxyProxy icon in the browser toolbar and select Burp Suite as the active proxy configuration.

This allows Burp Suite to intercept and inspect HTTP requests sent by the browser.

Step 2: Start Burp Suite

Launch Burp Suite and ensure the proxy is running.

Reload the target web page in the browser. The browser request will be intercepted by Burp Suite, allowing you to inspect and modify the HTTP request before it reaches the server.

Step 3: Send the Request to Repeater

In Burp Suite, right-click the intercepted request and select Send to Repeater.

The request will be transferred to the Repeater tab, where it can be manually modified and resent to the server for further HTTP method testing.

Step 4: Send a GET Request

In Burp Suite Repeater, set the HTTP request method to GET and send the request to the server.

Inspect the response to determine how the application handles the GET method and compare it with the other HTTP methods tested during enumeration.

Step 5: Send a HEAD Request

In Burp Suite Repeater, change the HTTP request method to HEAD and click Send.

Inspect the response to determine whether the server accepts the HEAD method and observe the returned HTTP headers.

Step 6: Send an OPTIONS Request

In Burp Suite Repeater, change the HTTP request method to OPTIONS and click Send.

Inspect the server response, particularly the Allow header, to identify the HTTP methods supported by the requested resource.

Step 7: Send a POST Request

In Burp Suite Repeater, change the HTTP request method to POST and click Send.

Inspect the response to determine whether the server accepts the POST method and how the application handles the request.

Step 8: Send a POST Request with Invalid Credentials

In Burp Suite Repeater, send a POST request to the login.php endpoint using incorrect login credentials.

Inspect the server's response to observe how the application handles an unsuccessful authentication attempt. This also confirms that login.php processes login data through the POST method.

Step 9: Send a POST Request with Valid Credentials

In Burp Suite Repeater, send a POST request to login.php using the valid login credentials.

The server responds with a 302 Found status code and redirects the request to index.php. This confirms that the supplied credentials were valid and the authentication was successful.

Step 10: Upload a File Using the PUT Method

Using Burp Suite Repeater, change the request method to PUT and send the request to the /uploads directory with the file content in the request body.

The server responds successfully, confirming that the PUT method can be used to upload files.

After sending the request, access the /uploads directory and verify that hello.txt has been created. Opening the file confirms that its contents were uploaded successfully.

Step 11: Delete the File

Using Burp Suite Repeater, change the request method to DELETE and send the request targeting the uploaded hello.txt file.

The server responds successfully, confirming that the file was deleted.

Check the /uploads directory again. The hello.txt file is no longer present, confirming that the DELETE method is enabled and functional.