Agent skill · security · jeremylongshore
probing-dangerous-http-methods
Probe a target for HTTP methods that should not be enabled in production — TRACE (XST attack), unrestricted PUT/DELETE, DEBUG/CONNECT, WebDAV (PROPFIND/MKCOL/COPY/MOVE), and Allow header enumeration. Use when: penetration test rules of engagement include HTTP method testing, OR a load balancer change went live and you suspect default methods were exposed. Threshold: TRACE returns 200 on any path (XST), PUT/DELETE returns anything other than 405/403/404 on a non-API endpoint, OPTIONS Allow header lists DEBUG/CONNECT/PROPFIND, or WebDAV methods succeed. Trigger with: "audit http methods", "trace check", "options enumeration", "webdav probe".
Why this skill is useful
Adds an executable Python script for probing HTTP methods that enhances security testing capabilities beyond standard practices.
What it needs
Requires python3 installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Probing Dangerous HTTP Methods Overview Most HTTP methods beyond GET/POST/HEAD are vestigial — leftover from WebDAV authoring stacks of the early 2000s, debugging features in legacy servers, or default-enabled methods nobody disabled at install time. Each enabled method that the application doesn't use is an attack surface: TRACE enables Cross-Site Tracing (XST), PUT enables arbitrary file upload to unprotected paths, CONNECT enables proxy abuse against internal services, WebDAV enables directory manipulation. This skill probes the canonical method set and grades each based on its presence and response. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- TRACE method enabled HIGH TRACE returns 200 with request echo OWASP A05:2021, CWE-693 PUT method enabled outside API path HIGH PUT returns 200/201/204 on non-API path CWE-434 DELETE method enabled outside API path HIGH DELETE returns 200/204 on non-API path CWE-285 CONNECT method enabled CRITICAL CONNECT returns 200 (proxy abuse open) CWE-441 DEBUG method enabled HIGH DEBUG returns response (legacy IIS / dev servers) CWE-489 WebDAV methods enabled (PROPFIND/MKCOL/COPY/MOVE) HIGH Any return 207 or 201 CWE-538 Allow header discloses unused methods LOW OPTIONS Allow includes methods app doesn't use CWE-200 OPTIONS returns full method enumeration LOW Allow: or broad list CWE-200 Prerequisites Python 3.9+ Authorization for non-local targets Instructions Step 1 — Confirm authorization Step 2 — Run the scanner Options: By default the scanner treats the URL as a non-API endpoint where PUT/DELETE should return 405. With --is-api, those methods are expected and don't trigger findings — only the auth checks behind them matter (delegated to other skills). Step 3 — Interpret findings CRITICAL CONNECT-open = your reverse proxy is letting external clients connect to arbitrary internal hosts (e.g., metadata endpoints in AWS/GCP). Ship same-hour fix. HIGH TRACE = XST attack open. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/probing-dangerous-http-methods--d46d95