nerdexam
EC-Council

312-50V10 · Question #784

When you are getting information about a web server, it is very important to know the HTTP Methods (GET, POST, HEAD, PUT, DELETE, TRACE) that are available because there are two critical methods…

The correct answer is A. http-methods. The Nmap Scripting Engine (NSE) includes a dedicated script to enumerate supported HTTP methods on a web server. Identifying dangerous methods like PUT and DELETE is a key step in web server reconnaissance.

Hacking Web Servers

Question

When you are getting information about a web server, it is very important to know the HTTP Methods (GET, POST, HEAD, PUT, DELETE, TRACE) that are available because there are two critical methods (PUT and DELETE). PUT can upload a file to the server and DELETE can delete a file from the server. You can detect all these methods (GET, POST, HEAD, DELETE, PUT, TRACE) using NMAP script engine. What Nmap script will help you with this task?

Options

  • Ahttp-methods
  • Bhttp enum
  • Chttp-headers
  • Dhttp-git

How the community answered

(48 responses)
  • A
    88% (42)
  • B
    4% (2)
  • C
    2% (1)
  • D
    6% (3)

Why each option

The Nmap Scripting Engine (NSE) includes a dedicated script to enumerate supported HTTP methods on a web server. Identifying dangerous methods like PUT and DELETE is a key step in web server reconnaissance.

Ahttp-methodsCorrect

The 'http-methods' NSE script sends an OPTIONS request to the target web server and lists all HTTP methods the server supports, including potentially dangerous ones like PUT, DELETE, and TRACE. It can also test each method individually and flag those considered risky. This makes it the precise tool for this enumeration task.

Bhttp enum

http-enum is used to enumerate directories and files on a web server using a wordlist, not to discover supported HTTP methods.

Chttp-headers

http-headers retrieves and displays the HTTP response headers from a server, not the list of allowed HTTP methods.

Dhttp-git

http-git is used to detect exposed .git repositories on a web server, not to enumerate HTTP methods.

Concept tested: Nmap NSE HTTP methods enumeration script

Source: https://nmap.org/nsedoc/scripts/http-methods.html

Topics

#Nmap scripting engine#HTTP methods#web server enumeration#PUT DELETE detection

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V10 Practice