About

Imported from jeremylongshore/tons-of-skills-marketplace (plugins/security/penetration-tester/skills/probing-dangerous-http-methods/SKILL.md). Install upstream with npx skills add jeremylongshore/tons-of-skills-marketplace --skill probing-dangerous-http-methods. Copyright stays with the author (MIT).

Probing Dangerous HTTP Methods

Name: probing-dangerous-http-methods
Author: jeremylongshore

Overview

Most HTTP methods beyond GET/POST/HEAD are vestigial — leftover from WebDAV authoring stacks of the early 2000s, debugging features in legacy servers, or default-enabled methods nobody disabled at install time. Each enabled method that the application doesn't use is an attack surface: TRACE enables Cross-Site Tracing (XST), PUT enables arbitrary file upload to unprotected paths, CONNECT enables proxy abuse against internal services, WebDAV enables directory manipulation.

This skill probes the canonical method set and grades each based on its presence and response.

When the skill produces findings

Finding	Severity	Threshold	Affected control
TRACE method enabled	HIGH	TRACE returns 200 with request echo	OWASP A05:2021, CWE-693
PUT method enabled outside API path	HIGH	PUT returns 200/201/204 on non-API path	CWE-434
DELETE method enabled outside API path	HIGH	DELETE returns 200/204 on non-API path	CWE-285
CONNECT method enabled	CRITICAL	CONNECT returns 200 (proxy abuse open)	CWE-441
DEBUG method enabled	HIGH	DEBUG returns response (legacy IIS / dev servers)	CWE-489
WebDAV methods enabled (PROPFIND/MKCOL/COPY/MOVE)	HIGH	Any return 207 or 201	CWE-538
Allow header discloses unused methods	LOW	OPTIONS Allow includes methods app doesn't use	CWE-200
OPTIONS returns full method enumeration	LOW	Allow:* or broad list	CWE-200

Prerequisites

Python 3.9+
Authorization for non-local targets

Instructions

Step 1 — Confirm authorization

"Do you have authorization to perform HTTP method probing on this
 target? I need confirmation before proceeding."

Step 2 — Run the scanner

python3 ${CLAUDE_PLUGIN_ROOT}/skills/probing-dangerous-http-methods/scripts/probe_methods.py \
    https://example.com \
    --authorized

Options:

Usage: probe_methods.py URL [OPTIONS]

Options:
  --authorized      Attest authorization (required)
  --output FILE
  --format FMT      json | jsonl | markdown (default: markdown)
  --min-severity SEV (default: info)
  --timeout SECS
  --is-api          Treat URL as API endpoint (relaxes PUT/DELETE checks)

By default the scanner treats the URL as a non-API endpoint where PUT/DELETE should return 405. With --is-api, those methods are expected and don't trigger findings — only the auth checks behind them matter (delegated to other skills).

Step 3 — Interpret findings

CRITICAL CONNECT-open = your reverse proxy is letting external clients connect to arbitrary internal hosts (e.g., metadata endpoints in AWS/GCP). Ship same-hour fix.

HIGH TRACE = XST attack open. Combined with any XSS, attacker can read HttpOnly cookies via XHR. Ship-within-sprint fix.

HIGH WebDAV = file upload + manipulation surface. Audit references/ PLAYBOOK.md § disabling WebDAV.

Step 4 — Cross-skill chaining

After this skill, suggest:

auditing-cors-policy (#3) if Allow-Methods:* surfaced
detecting-debug-endpoints (#7) for the broader exposed-feature audit if DEBUG/TRACE both fired

Examples

Example 1 — Post-deploy method audit

User: "We rolled out a new ALB config. Audit the method surface."

python3 ${CLAUDE_PLUGIN_ROOT}/skills/probing-dangerous-http-methods/scripts/probe_methods.py \
    https://api.example.com \
    --authorized --is-api --min-severity high

Example 2 — TRACE / XST audit after XSS finding

User: "Found XSS on /search; checking if XST chain is possible."

python3 ${CLAUDE_PLUGIN_ROOT}/skills/probing-dangerous-http-methods/scripts/probe_methods.py \
    https://example.com \
    --authorized

If TRACE-enabled finding fires, the XST chain works: attacker XSS issues a TRACE request via XHR, the server echoes the request (including HttpOnly cookies that XHR-set-cookies access can't normally read), JavaScript reads the response body, full session theft.

Example 3 — WebDAV legacy audit on a recently-acquired domain

User: "We just acquired example.io — quick method-surface check before we re-point DNS."

python3 ${CLAUDE_PLUGIN_ROOT}/skills/probing-dangerous-http-methods/scripts/probe_methods.py \
    https://example.io \
    --authorized --min-severity medium

Often surfaces decade-old WebDAV / DEBUG defaults that nobody disabled on the previous owner's stack.

Output

JSON / JSONL / Markdown. Exit 0 / 1 / 2 per lib/report.py.

Error Handling

Method returns 405 → expected behavior, no finding
Method returns 403 → access-controlled (acceptable), no finding, but INFO note recorded
Method returns 500 → INFO finding flagging error-handling concern
Connection error → exit 2

Resources

references/THEORY.md — Per-method attack semantics
references/PLAYBOOK.md — How to disable each method per server type
../analyzing-tls-config/references/AUTHORIZATION.md — Active-scan authorization

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/jeremylongshore-tons-of-skills-marketplace-probing-dange-972cd8/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

jeremylongshore-tons-of-skills-marketplace-probing-dange-972cd8.ocm.jsonjson

{
  "ocm": "1",
  "id": "jeremylongshore-tons-of-skills-marketplace-probing-dange-972cd8",
  "kind": "skill",
  "name": "probing-dangerous-http-methods",
  "description": "Probe a target for HTTP methods that should not be enabled in production — TRACE (XST attack), unrestricted PUT/DELETE, DEBUG/CONNECT, WebDAV (PROPFIND/MKCOL/COPY/MOVE), and Allow header enumeration. Use when: penetration test rules of engagement include HTTP method testing, OR a load balancer change went live and you suspect default methods were exposed. Threshold: TRACE returns 200 on any path (XST), PUT/DELETE returns anything other than 405/403/404 on a non-API endpoint, OPTIONS Allow header lists DEBUG/CONNECT/PROPFIND, or WebDAV methods succeed. Trigger with: \"audit http methods\", \"trace check\", \"options enumeration\", \"webdav probe\".",
  "publisher": "jeremylongshore",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding",
      "math"
    ],
    "tags": [
      "skill-md",
      "security",
      "http-methods",
      "xst",
      "webdav",
      "pentest",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Probe a target for HTTP methods that should not be enabled in production — TRACE (XST attack), unrestricted PUT/DELETE, DEBUG/CONNECT, WebDAV (PROPFIND/MKCOL/COPY/MOVE), and Allow header enumeration. Use when: penetration test rules of engagement include HTTP method testing, OR a load balancer change went live and you suspect default methods were exposed. Threshold: TRACE returns 200 on any path (XST), PUT/DELETE returns anything other than 405/403/404 on a non-API endpoint, OPTIONS Allow header lists DEBUG/CONNECT/PROPFIND, or WebDAV methods succeed. Trigger with: \"audit http methods\", \"trace check\", \"options enumeration\", \"webdav probe\"."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/jeremylongshore/tons-of-skills-marketplace",
      "path": "plugins/security/penetration-tester/skills/probing-dangerous-http-methods/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/jeremylongshore/tons-of-skills-marketplace/blob/HEAD/plugins/security/penetration-tester/skills/probing-dangerous-http-methods/SKILL.md",
      "key": "jeremylongshore/tons-of-skills-marketplace/plugins/security/penetration-tester/skills/probing-dangerous-http-methods/SKILL.md"
    },
    "compatibility": "Designed for Claude Code",
    "allowed_tools": [
      "Read",
      "Bash(python3:*)",
      "Bash(curl:*)"
    ],
    "license": "MIT"
  },
  "instructions": "# Probing Dangerous HTTP Methods\n\n## Overview\n\nMost HTTP methods beyond GET/POST/HEAD are vestigial — leftover from\nWebDAV authoring stacks of the early 2000s, debugging features in\nlegacy servers, or default-enabled methods nobody disabled at install\ntime. Each enabled method that the application doesn't use is an\nattack surface: TRACE enables Cross-Site Tracing (XST), PUT enables\narbitrary file upload to unprotected paths, CONNECT enables proxy\nabuse against internal services, WebDAV enables directory manipulation.\n\nThis skill probes the canonical method set and grades each based on\nits pres",
  "cost": {
    "context_tokens": 1255
  }
}

Fetch it by URL: GET /api/v1/registry/jeremylongshore-tons-of-skills-marketplace-probing-dange-972cd8/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.