Re: http TRACE option

["JosŽé M. Palazón Romero" <josem.palazon () gmail com>]

pentestr escribió:
> Hi,
> what is the issue if TRACE option is enabled in web servers ? Nessus 
> results always display it as warning.
> any idea...

Cross Site Tracing, or XST. You have a great paper about it here:

http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf

Basically, the topic is about bypassing the httpOnly protection for 
cookies included in IE (and Firefox v3). If the programmer uses httpOnly 
 for the cookies, they cannot be accessed via Javascript, so a tipical 
XSS attack would fail stealing document.cookies. However, an asyncronous 
XmlHTTPRequest can be done to the server with a TRACE query, and the 
results from the server (if activated) would be the same contents that 
it received (sort of an echo service for http), including the http 
headers that were sent with the TRACE request. Cookie information is in 
these headers, so now you can access to it by parsing the TRACE response.

Regards

Jose

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------