WebDAV

WebDAV

WebDAV extends HTTP with verbs for listing, creating, moving, and writing files, turning a web server into a mountable, writable filesystem. The offensive surface is discovering the enabled verbs, bypassing weak authentication, traversing outside the intended collection, and using PUT or MOVE to place an executable file in a web-interpreted path for code execution.

1 min di letturaaggiornato il 5 ott 2026

1 contributore

WebDAV (Web Distributed Authoring and Versioning) adds verbs to HTTP, PROPFIND (list and read properties), PUT (write a file), MKCOL (make a collection), MOVE, COPY, DELETE, LOCK, so a web server becomes a mountable, writable filesystem. That read-write capability is the attack surface. The moves are discovering which verbs are enabled and what they expose, bypassing authentication that is often weak or inconsistently applied, traversing outside the intended collection, and, most impactful, using PUT (sometimes combined with MOVE to dodge an extension filter) to plant a server-executable file for code execution.

bash

# detect WebDAV and its verbs
curl -s -X OPTIONS http://<target>/ -i | grep -iE 'allow|dav'   # DAV header + verbs
davtest -url http://<target>/                 # tests PUT and which extensions execute

Subtopics#

Discovery and methods: finding WebDAV and its enabled verbs.
Authentication bypass: reaching DAV verbs past weak auth.
Directory traversal: escaping the intended collection.
PUT upload to RCE: planting an executable file via PUT/MOVE.

Subtopics#

References#