Lab 01 – Web - HTTP Method Enumeration
Overview
This lab focuses on enumerating and testing HTTP methods on a web server. You will learn to interact with various web pages of the application to discover supported HTTP methods and explore the potential for unauthorized actions like file uploads and deletions.
Tasks
Lab Environment
In this lab environment, you will be provided with GUI access to a Kali machine. The target machine will be accessible at demo.ine.local.
Objective: To understand and identify the HTTP methods supported by different web pages within a web application
Tools
The best tools for this lab are:
Burp Suite
Curl
DiRB
Solutions
In this exercise, we will take a look at how to use Burp Suite and curl to enumerate the HTTP Methods supported by various web pages. Inspecting the web application.
Inspecting the web application
There are two new links which can be followed from the home page. The login link on the navigation bar and the blog post. The login link redirects to "login.php" and the Blog link redirects to "post.php".
Following Links: Click on the login Link
URL: http://demo.ine.local/login.php
The login page contains a form.
Identify the endpoint which processes the form fields. Right-click on the web page and click on the view source
The parameters are passed in a POST request to the same "login.php" page.
Login to the web application with the provided credentials.
Username: john Password: password
After login instead of the login link "Welcome John" message is displayed.
Follow the remaining link. Click on the blog post
The Web pages which can be accessed by following the links are index.php, login.php and post.php.
Using dirb to identify hidden directories
Commands:
The directories which are present on the server are css, img, js, mail, uploads and vendor.
Interacting with the home page with CURL
Sending GET request
Commands:
Sending HEAD request
Commands:
Sending OPTIONS request
Commands:
The supported methods are GET, HEAD and OPTIONS. Accessing the web page should produce an error.
Sending POST Request
Commands:
Sending PUT Request
Commands:
Interacting with the login.php page with CURL
Sending OPTIONS Request
Commands:
The allowed methods include: GET,POST,HEAD,OPTIONS.
Sending POST Request
Commands:
Unlike the home page (index.php). The login page supports POST method.
Passing the username and password to the login.php page
Command:
The login page returned a different response than before. The response contains 302 redirects.
Interacting with the post.php page with CURL
Sending OPTIONS request
Commands:
Similar to login.php, post.php has GET, POST, HEAD and OPTIONS methods enabled.
Interacting with the uploads directory
Checking the content of /uploads directory
URL: http://demo.ine.local/uploads
Sending OPTIONS request to /uploads directory
Commands:
The Webdav module is enabled on the Apache Server, Webdav module allows file upload via the PUT method.
Uploading a file with the PUT method
Commands:
Checking the content of /uploads directory
The file "hello.txt" was uploaded successfully.
Using the DELETE method to delete the file
Command:
Checking the content of /uploads directory
The file was deleted successfully.
Interacting with the web page with Burp Suite
Set the FoxyProxy to use the burp proxy. Click on the Fox icon and select "Burp Suite"
Start burp suite. Reload the page and the request will be intercepted
Sending request to Repeater
Repeater Tab:
Sending GET Request
Repeater Tab:
Response Tab:
Sending HEAD Request
Response Tab:
Sending OPTIONS request
Response Tab:
Sending POST request
Response Tab:
POST method is not allowed.
Sending a POST request to login.php with incorrect login credentials
Response Tab:
200 OK responses are received.
Sending POST request with valid login credentials
Response Tab:
The login credentials were correct and as a result, 302 responses were received to index.php.
Uploading a file with the PUT method
Response Tab:
The file was uploaded Successfully.
Check the files in the/uploads directory.
Response Tab:
The file "hello.txt" was uploaded successfully.
Checking the Content of the uploaded file.
Response Tab:
Deleting the File
Response Tab:
The file was deleted. Check the files in the uploads directory.
Response Tab:
References
Last updated