TRACE/TRACK Method Detected

adripillo said:
Does anyone know how to disable this? Thanks.
Click to expand...
Why do you think it needs to be disabled?

The HTTP protocol has several methods which are being used to send or retrieve information (from the servers point of view), amongst which HEAD and GET, and these are actually considered to be safe methods.

So I think this either depends on context (related to the kind of scan you executed) or is simply an overview of your webserver capabilities.
 
Under certain circumstances, the TRACE method can be exploited for a Cross Site Tracing attack, and in some flawed setups, the HEAD method can be utilized for HEAD access control bypass.

I consider the first a problem inherited by the design of the TRACE method, while the second problem is not really a problem of the HEAD method, but the utilized authentication implementation needs to be fixed.

So, I disabled TRACE on my apache web servers by adding the following directive to /usr/local/etc/apache2x/httpd.conf, and I am happily living with the HEAD method.

Code: 
...
TraceEnable off
...
 
ShelLuser said:
Why do you think it needs to be disabled?

The HTTP protocol has several methods which are being used to send or retrieve information (from the servers point of view), amongst which HEAD and GET, and these are actually considered to be safe methods.

So I think this either depends on context (related to the kind of scan you executed) or is simply an overview of your webserver capabilities.
Click to expand...

So you mean that is ok?
 
rolfheinrich said:
Under certain circumstances, the TRACE method can be exploited for a Cross Site Tracing attack, and in some flawed setups, the HEAD method can be utilized for HEAD access control bypass.

I consider the first a problem inherited by the design of the TRACE method, while the second problem is not really a problem of the HEAD method, but the utilized authentication implementation needs to be fixed.

So, I disabled TRACE on my apache web servers by adding the following directive to /usr/local/etc/apache2x/httpd.conf, and I am happily living with the HEAD method.

Code: 
...
TraceEnable off
...
Click to expand...

Thank you.
 
Hello, I was running a test on my server and found this "security fail". Does anyone know how to solve it?
 
wblock@ said:
Nearly zero details are present here. What test was run, and how? What file was modified?
Click to expand...

I really do not know the name of test, was executed from outside by a friend. The file that modify to add that entry is httpd.conf
 
Sorry but what you have offered is zero use to anyone else. No details of what the problem was and no explanation how your "fix" actually helps.
 
You must log in or register to reply here.
Back
Top