> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/introduction-to-the-web-and-http-protocol/http-method-enumeration.md).

# HTTP Method Enumeration

### Web and HTTP Protocol 

```
ip a 
```

* browse to http\://\<targetIP>/login.php
* view source page check the login form
* john::password

```
dirb http://<targetIP>/
```

* curl

curl -X \<methods> \<targetIP>

```
curl -X GET <targetIP>
```

* HEAD request&#x20;

```
curl -I <targetIP>
```

```
curl -X OPTIONS <targetIP> -v
```

```
curl -X POST <targetIP>/login.php -v
```

* curl for log in&#x20;

```
curl -X POST <IP>/login.php -d "name=john&password=password" -v
```

* &#x20;POST

```
curl -X POST <IP>/post.php -v
```

```
curl -X OPTIONS <IP>/uploads/ -v
```

* As upload.php allows PUT method we can add files

```
echo "Hello World" > hello.txt
```

```
curl <IP>/uploads/ --upload-file hello.txt
```

* To read a file

```
curl <IP>/uploads/hello.txt
```

* To delete a file

```
curl -X DELETE <IP>/uploads/hello.txt
```

**BURPSUITE**

* Intercept the home page request&#x20;
* send to the repeater
* change the Header to OPTIONS/HEAD and you can see the same as Curl results in response

Uploading file through Burpsuite

* Intercept the login.php page request&#x20;
* change it to PUT /uploads/hello.txt
* Change Content-Length to 11
* add "Hello World" at the end of request&#x20;

To read file&#x20;

* GET /uploads/hello.txt

To Delete

* DELETE /uploads/hello.txt

*Note: When you find things like this, you need to identify them to your customer, your client, through your report and talk about*

* &#x20;*what is your actual on the business ?*
* *What is the impact to the CIA triad ?*
* *Could they lose information that they want to keep secure ?*
* *Could they lose access ?*
* *Might you be able to change the integrity of files by uploading new files and possibly overriding what already exists ?*
* *Perhaps we might be able to put an executable file that runs on its own. We could do remote code execution in that way. If it's allowed, and if we can figure it out.*