Testing for HTTP verb tampering

HTTP requests can include methods beyond GET and POST. As a penetration tester, it is important to determine which other HTTP verbs (that is, methods) the web server allows. Support for other verbs may disclose sensitive information (for example, TRACE) or allow for a dangerous invocation of application code (for example, DELETE). Let’s see how Burp Suite can help test for HTTP verb tampering.

Getting ready

Using Altoro Mutual (https://demo.testfire.net), let’s determine whether the application has a POST request we can manipulate into using a GET instead. If possible, the GET request will expose sensitive data within the query string. We will login first, then map the application to look for something interesting like a money movement transaction.

How to do it...

1. Navigate to https://demo.testfire.net. Click the Sign In button.

Figure 8.12 – Altoro Mutual landing page

You are brought...