0

I’m running Apache/2.2.15 (Unix) on a RHEL system. My LAMP is running on localhost.

I want to check if the HTTP methods:

  • POST
  • GET
  • PUT
  • DELETE

are allowed and enabled.

I’ve read that they can be checked with netcat or telnet https://www.owasp.org/index.php/Test_HTTP_Methods_(OTG-CONFIG-006)

When I try netcat, this is what I get:

[root@joseph ~]# nc localhost 80
OPTIONS / HTTP/1.1
HTTP/1.1 400 Bad Request
Date: Fri, 15 Sep 2017 20:17:12 GMT
Server: Apache/2.2.15 (Red Hat)
Content-Length: 302
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not     understand.<br />
</p>
<hr>
<address>Apache/2.2.15 (Red Hat) Server at 127.0.0.1 Port 80</address>
</body></html>

When I try telnet, this is what I get:

[root@joseph ~]# telnet localhost 80
Trying ::1...
Connected to localhost.
Escape character is '^]'.
OPTIONS / HTTP/1.0
Host localhost

HTTP/1.1 400 Bad Request
Date: Fri, 15 Sep 2017 19:48:30 GMT
Server: Apache/2.2.15 (Red Hat)
Content-Length: 302
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not     understand.<br />
</p>
<hr>
<address>Apache/2.2.15 (Red Hat) Server at 127.0.0.1 Port 80</address>
</body></html>
Connection closed by foreign host.

I understand that getting a "400 Bad Request" can be due to malformed syntax https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html

But when I’m just sending telnet or netcat commands, how could that be?

Flimzy
  • 2,454
  • 18
  • 26
Joe
  • 109
  • 1
  • 2
  • 1
    why you don't use curl? – c4f4t0r Sep 17 '17 at 04:57
  • 1
    Down voters: please give reasons – Joe Sep 18 '17 at 14:23
  • Thank you @c4f4t0r for that excellent advice. That was my answer! I ran `curl -i -X OPTIONS localhost`. That worked; there was no "Bad Request". On the fourth line, from curl, I saw what I was hoping to see: `Allow: GET,HEAD,POST,OPTIONS,TRACE`. – Joe Sep 18 '17 at 14:32

1 Answers1

1

Neither your nc attempt nor your telnet attempt provided a valid HTTP Host request header. It is not allowed to send an HTTP/1.1 request without this header, and such requests must be rejected with a 400 Bad Request response.

In the first case it was missing, and in the second case it was indeed malformed.

That header should have appeared as:

Host: localhost
Michael Hampton
  • 244,070
  • 43
  • 506
  • 972