EC-Council Certified Ethical Hacker (CEH) v12Web Application HackingHard
An attacker is attempting to exploit a web server that is misconfigured to allow HTTP TRACE requests. What is the primary purpose of leveraging an HTTP TRACE request in an attack scenario?
- ATo perform a reflected Cross-Site Scripting (XSS) attack.
- BTo discover the web server's internal IP address.
- CTo retrieve the web server's SSL/TLS certificate details.
- DTo bypass network firewalls and access internal resources.
Show answer & explanationAnswer & explanation
Correct answer: A. To perform a reflected Cross-Site Scripting (XSS) attack.
HTTP TRACE method, if enabled, reflects the exact request headers back to the client. This vulnerability, known as Cross-Site Tracing (XST), can be leveraged to steal HTTPOnly cookies by chaining it with a reflected XSS vulnerability. The XSS payload would make a TRACE request, and the response containing the cookies would then be accessible via JavaScript.
Why the other options are wrong
- B. An internal IP address is usually disclosed through server errors, misconfigurations, or SSRF, not directly by an HTTP TRACE request reflection.
- C. SSL/TLS certificate details are typically retrieved through tools like OpenSSL or by inspecting the certificate in a browser, not via HTTP TRACE.
- D. HTTP TRACE does not inherently bypass network firewalls or access internal resources; it reflects the request.
Cross-Site Tracing (XST)
An attack that leverages the HTTP TRACE method to steal HTTPOnly cookies, often in conjunction with a reflected XSS vulnerability.
- Exploits web servers that allow the HTTP TRACE method.
- Allows an attacker to view raw request headers, including HTTPOnly cookies.
- Mitigation: Disable the HTTP TRACE method on web servers.
Memory trick: TRACE reflects, XSS steals cookies.