|
tyr3ll
|
 |
« on: July 03, 2012, 10:30:34 AM » |
|
Hello! As everyone knows the PUT Method can be a concern when allowed on webservers. I've been through some tests which raise questions i'd like to submit here:
Using the OPTIONS method, we ask the server what methods are allowed for the root path '/' : hey@nix:~/# echo -e "OPTIONS / HTTP/1.0\n" | nc -v server 80
HTTP/1.0 200 OK Date: Tue, 03 Jul 2012 13:06:15 GMT Server: Apache/1.3.27 (Unix) PHP/4.3.9 Content-Length: 0 Allow: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, PATCH, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK, TRACE
Great, the apache server says PUT is allowed for '/'. Now, we know there are the following directories on the server: /c/ /manual/ /icons/
Issuing the OPTIONS method again on the '/c/' directory give us: hey@nix:~/# echo -e "OPTIONS /c/ HTTP/1.0\n" | nc -v server 80
HTTP/1.0 200 OK Date: Tue, 03 Jul 2012 13:16:55 GMT Server: Apache/1.3.27 (Unix) PHP/4.3.9 Content-Length: 0 Allow: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, PATCH, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK, TRACE
The very same results as for the '/' root directoy: PUT is ALLOWED. Now, the '/manual/ directory says the same. However for the '/icons/' dir, the server answers that only GET, HEAD, OPTIONS, TRACE are allowed.
Well, trying to use the PUT Method to upload a .txt file to the root folder or to '/manual/' get a negative response: "405 Method Not Allowed The requested method PUT is not allowed for the URL /manual/test.txt."
Of Course the directory i'm trying to upload something to should also be writable for the PUT to succeed, but why then the HTTP response is telling us that PUT is not allowed?
More important, why some directories replies that PUT is allowed and some dont?
|