59 lines
1.8 KiB
Markdown
59 lines
1.8 KiB
Markdown
## Vulnerable Application
|
|
|
|
This module checks if the host(s) is(are) vulnerable to Cross-Site Tracing (XST).
|
|
The module does more than just check for the HTTP Trace method, and actually
|
|
attempts a trace request to verify that XST is possible.
|
|
|
|
### Setting up Web Servers with the TRACE Method
|
|
|
|
This [link](https://www.virtuesecurity.com/kb/web-server-trace-enabled/) describes how
|
|
to disable the HTTP TRACE method. In order to enable it, simply follow the opposite of
|
|
these instructions (e.g. set `TraceEnable` to `on` for Apache).
|
|
|
|
## Verification Steps
|
|
|
|
1. Start `msfconsole`
|
|
1. `use auxiliary/scanner/http/trace`
|
|
1. `set RHOSTS [ip]`
|
|
1. `set RPORT [port]`
|
|
1. `run`
|
|
1. Check output for presence of XST
|
|
|
|
## Options
|
|
|
|
## Scenarios
|
|
|
|
You can use this module on a single target or several targets. See below for single target usage:
|
|
|
|
```
|
|
msf6 > use auxiliary/scanner/http/trace
|
|
msf6 auxiliary(scanner/http/trace) > set RHOSTS YYY.YY.YYY.YYY
|
|
RHOSTS => YYY.YY.YYY.YYY
|
|
msf6 auxiliary(scanner/http/trace) > set RPORT 443
|
|
RPORT => 443
|
|
msf6 auxiliary(scanner/http/trace) > set SSL true
|
|
[!] Changing the SSL option's value may require changing RPORT!
|
|
SSL => true
|
|
msf6 auxiliary(scanner/http/trace) > run
|
|
|
|
[+] YYY.YY.YYY.YYY:443 is vulnerable to Cross-Site Tracing
|
|
```
|
|
|
|
## Confirming with Nmap
|
|
|
|
```
|
|
nmap -sV -Pn [ip] --script=http-trace -p 443
|
|
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
|
|
Starting Nmap 7.91 ( https://nmap.org ) at 2021-10-21 20:30 EDT
|
|
Nmap scan report for www.hphc.org ([ip])
|
|
Host is up (0.029s latency).
|
|
|
|
PORT STATE SERVICE VERSION
|
|
443/tcp open ssl/http Apache httpd
|
|
|_http-server-header: Apache
|
|
|_http-trace: TRACE is enabled
|
|
|
|
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
|
|
Nmap done: 1 IP address (1 host up) scanned in 13.53 seconds
|
|
```
|