PT0-002 · Question #438
During a security assessment, a penetration tester decides to write the following Python script: import requests x= ['OPTIONS', 'TRACE', 'TEST'l for y in x; print(y, z.status_code, z.reason) Which…
The correct answer is B. HTTP methods availability D. 'Web server fingerprinting. The script iterates through a list of HTTP methods (OPTIONS, TRACE, and a non-standard TEST) and sends each as an HTTP request, capturing the status code and reason phrase. Sending OPTIONS reveals which HTTP methods the server supports (B - HTTP methods availability), as a…
Question
During a security assessment, a penetration tester decides to write the following Python script:
import requests x= ['OPTIONS', 'TRACE', 'TEST'l for y in x; print(y, z.status_code, z.reason) Which of the following is the penetration tester trying to accomplish? (Select two).
Options
- AWeb server denial of service
- BHTTP methods availability
- C'Web application firewall detection
- D'Web server fingerprinting
- EWeb server error handling
- FWeb server banner grabbing
How the community answered
(20 responses)- A10% (2)
- B80% (16)
- C5% (1)
- E5% (1)
Explanation
The script iterates through a list of HTTP methods (OPTIONS, TRACE, and a non-standard TEST) and sends each as an HTTP request, capturing the status code and reason phrase. Sending OPTIONS reveals which HTTP methods the server supports (B - HTTP methods availability), as a properly configured server will return an 'Allow' header listing permitted methods. Observing how the server responds to standard and non-standard methods - including status codes and reason phrases - helps identify the server software and version (D - Web server fingerprinting), since different servers respond differently to unusual or invalid methods. DoS, WAF detection, error handling analysis, and banner grabbing are not the primary goals of this specific script structure.
Topics
Community Discussion
No community discussion yet for this question.