WebDAV enumeration establishes whether DAV is present, which verbs are enabled, and what writes achieve. The DAV header in an OPTIONS response confirms WebDAV and its compliance class; the Allow header lists the verbs. PROPFIND enumerates collections and files (WebDAV's listing), and a controlled PUT test shows whether uploads are accepted and, crucially, which uploaded extensions the server executes versus serves inert. That last point decides whether an upload is code execution or just a file.
# verbs and DAV support
curl -s -X OPTIONS http://<target>/ -i | grep -iE 'allow:|dav:'
# PROPFIND listing (Depth: 1 lists the immediate collection)
curl -s -X PROPFIND http://<target>/ -H 'Depth: 1' --data '' | grep -oE '<D:href>[^<]+'
# automated: which extensions can be uploaded and which execute
davtest -url http://<target>/
cadaver http://<target>/ # interactive DAV client (ls, put, move)
Read the davtest output specifically for which extensions both uploaded successfully and executed; that is the list of usable payload types for PUT upload to RCE.
Exploitation notes#
- The
DAVheader presence and a verb list includingPUT/MKCOL/MOVEmark a writable WebDAV worth attacking; a read-only DAV (only PROPFIND/GET) still enables listing and traversal. davtestis the fastest way to learn the executable-extension set; where PUT of.php/.jsp/.aspxis blocked but another executable type (or MOVE-rename) works, that is the path.- PROPFIND listing reveals files and collections that are not otherwise linked, like a directory listing, feeding both looting and the traversal/upload targets.
- Enumerate as each identity you have (anonymous and any credentials), since verb availability often differs by authentication, which motivates the authentication bypass step.