🧰

HTTP Methods Enumeration

Probes a server to discover which HTTP verbs it accepts, flagging dangerous methods such as TRACE, PUT, DELETE and WebDAV verbs.

SPEC: RFC 9110
CHECKED: GET, POST, PUT, DELETE, TRACE, WebDAV verbs
RISK PATTERN: Server-level PUT/DELETE, TRACE

What is HTTP Methods Enumeration?

HTTP methods declare what action a request intends. Most sites need only GET, POST, HEAD and OPTIONS; anything the web server accepts beyond that is unnecessary attack surface the application may never have intended to expose.

How it Works

The tool sends an OPTIONS request to read the advertised Allow header, then probes each method individually since that header is frequently inaccurate, recording which verbs the server genuinely accepts.

Key Use Cases

Confirming TRACE is disabled, since it was historically used in cross-site tracing attacks against cookies.

Checking whether PUT or DELETE are handled at the web-server level, which can bypass application authorisation entirely.

Detecting an accidentally enabled WebDAV module exposing filesystem operations over HTTP.

Advanced Details

Some frameworks apply access-control rules to a named list of methods, so a request using an unlisted or invented verb can sometimes reach a handler without passing the intended authorisation check.

Cybersecurity Pros & Cons

Security Advantages
  • Identifies TRACE support, which has no legitimate production use and should always be disabled.
  • Catches server-level PUT/DELETE handlers that bypass the application code path entirely.
  • Detects WebDAV verbs (PROPFIND, MKCOL, COPY, MOVE) that expose a filesystem protocol nobody intended to publish.
  • Reveals when the advertised Allow header does not match what the server actually accepts.
Security Limitations
  • A clean method list does not rule out method-based access-control bypass at the application layer.
  • Probing every method individually generates more requests and log noise than a passive OPTIONS check alone.
  • Results reflect only the endpoint tested; method restrictions are frequently configured inconsistently across an API.
Ready to Test?

Use our professional-grade tool to perform a real-time check for this module.

Run Module Now
Related Docs