Probing Dangerous HTTP Methods

Overview

Most HTTP methods beyond GET/POST/HEAD are vestigial — leftover from

WebDAV authoring stacks of the early 2000s, debugging features in

legacy servers, or default-enabled methods nobody disabled at install

time. Each enabled method that the application doesn't use is an

attack surface: TRACE enables Cross-Site Tracing (XST), PUT enables

arbitrary file upload to unprotected paths, CONNECT enables proxy

abuse against internal services, WebDAV enables directory manipulation.

This skill probes the canonical method set and grades each based on

its presence and response.

When the skill produces findings

Prerequisites

• Python 3.9+
• Authorization for non-local targets

Instructions

Step 1 — Confirm authorization

"Do you have authorization to perform HTTP method probing on this
 target? I need confirmation before proceeding."

Step 2 — Run the scanner

python3 ${CLAUDE_PLUGIN_ROOT}/skills/probing-dangerous-http-methods/scripts/probe_methods.py \
    https://example.com \
    --authorized

Options:

Usage: probe_methods.py URL [OPTIONS]

Options:
  --authorized      Attest authorization (required)
  --output FILE
  --format FMT      json | jsonl | markdown (default: markdown)
  --min-severity SEV (default: info)
  --timeout SECS
  --is-api          Treat URL as API endpoint (relaxes PUT/DELETE checks)

By default the scanner treats the URL as a non-API endpoint where

PUT/DELETE should return 405. With --is-api, those methods are

expected and don't trigger findings — only the auth checks behind them

matter (delegated to other skills).

Step 3 — Interpret findings

CRITICAL CONNECT-open = your reverse proxy is letting external clients

connect to arbitrary internal hosts (e.g., metadata endpoints in

AWS/GCP). Ship same-hour fix.

HIGH TRACE = XST attack open. Combined with any XSS, attacker can

read HttpOnly cookies via XHR. Ship-within-sprint fix.

HIGH WebDAV = file upload + manipulation surface. Audit `references/

PLAYBOOK.md` § disabling WebDAV.

Step 4 — Cross-skill chaining

After this skill, suggest:

• auditing-cors-policy (#3) if Allow-Methods:* surfaced
• detecting-debug-endpoints (#7) for the broader exposed-feature

audit if DEBUG/TRACE both fired

Examples

Example 1 — Post-deploy method audit

User: "We rolled out a new ALB config. Audit the method surface."

python3 ${CLAUDE_PLUGIN_ROOT}/skills/probing-dangerous-http-methods/scripts/probe_methods.py \
    https://api.example.com \
    --authorized --is-api --min-severity high

Example 2 — TRACE / XST audit after XSS finding

User: "Found XSS on /search; checking if XST chain is possible."

python3 ${CLAUDE_PLUGIN_ROOT}/skills/probing-dangerous-http-methods/scripts/probe_methods.py \
    https://example.com \
    --authorized

If TRACE-enabled finding fires, the XST chain works: attacker XSS

issues a TRACE request via XHR, the server echoes the request

(including HttpOnly cookies that XHR-set-cookies access can't normally

read), JavaScript reads the response body, full session theft.

Example 3 — WebDAV legacy audit on a recently-acquired domain

User: "We just acquired example.io — quick method-surface check before

we re-point DNS."

python3 ${CLAUDE_PLUGIN_ROOT}/skills/probing-dangerous-http-methods/scripts/probe_methods.py \
    https://example.io \
    --authorized --min-severity medium

Often surfaces decade-old WebDAV / DEBUG defaults that nobody disabled

on the previous owner's stack.

Output

JSON / JSONL / Markdown. Exit 0 / 1 / 2 per lib/report.py.

Error Handling

• Method returns 405 → expected behavior, no finding
• Method returns 403 → access-controlled (acceptable), no finding,

but INFO note recorded

• Method returns 500 → INFO finding flagging error-handling concern
• Connection error → exit 2

Resources

• references/THEORY.md — Per-method attack semantics
• references/PLAYBOOK.md — How to disable each method per server type
• ../analyzing-tls-config/references/AUTHORIZATION.md — Active-scan

authorization