Hack The Sec-Leading Resource Of Linux Tutorial: Trace_method

Disabling the TRACE method in Apache2

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<h1 class="western">
<span style="color: #990000;"><span style="font-family: istok web, sans-serif; font-size: x-large;"><u><i>Disabling
the TRACE method in Apache2</i></u></span></span></h1>
<h1 style="background-color: white; border: none; margin: 0px;">
<div align="LEFT" style="margin-bottom: 0in; orphans: 1;">
<span style="color: black;"><span style="font-family: Georgia, Times New Roman, serif; font-size: large;"><span style="font-weight: normal;">By
default, </span><a href="http://www.hackthesec.co.in/search/label/Apache" target="_blank">Apache2 </a><span style="font-weight: normal;">supports the </span>HTTP <span style="font-weight: normal;">TRACE method, which could expose
your server to certain Cross-Site Scripting attacks. In this
tutorial, I will show you how to check for TRACE support on your
<a href="http://www.hackthesec.co.in/search/label/Apache" target="_blank">Apache2 </a>server using curl, and then switch it off if it is enabled.</span></span></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsqRHtym_vFI-Wol6O32jFlSlnzFqddnTbPadAk3_dpHLmRX-4f0htUdDxAB61V39wWlI3eP7uSarHbzIUwrooJjuua1rUYNSd8TkLqpeWjqEfKLSdBeKFSX1eBnqeuigU5yUPWbMTYCa6/s1600/apache_asf_logo_url_www.hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="129" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsqRHtym_vFI-Wol6O32jFlSlnzFqddnTbPadAk3_dpHLmRX-4f0htUdDxAB61V39wWlI3eP7uSarHbzIUwrooJjuua1rUYNSd8TkLqpeWjqEfKLSdBeKFSX1eBnqeuigU5yUPWbMTYCa6/s320/apache_asf_logo_url_www.hackthesec.co.in.png" width="320" /></a></div>
<div align="LEFT" style="font-family: 'istok web', sans-serif; font-size: 18pt; margin-bottom: 0in; orphans: 1;">
<br />
</div>
</h1>
<h2 align="LEFT" class="western" style="background: #ffffff; margin-bottom: 0in; margin-top: 0in; orphans: 1;">
<code class="western"><span style="color: #0b5394;"><span style="font-family: istok web, sans-serif; font-size: x-large;"><u>Testing
for TRACE support with curl</u></span></span></code></h2>
<h1 style="background-color: white; border: none; margin: 0px;">
<div align="LEFT" style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; font-family: 'istok web', sans-serif; margin-bottom: 0in; orphans: 1;">

</div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;"><span style="color: white;">$ curl -i -X TRACE http://www.linuxtutorial.net/
HTTP/1.1 200 OK
Date: Wed, 13 Feb 2013 14:22:56 GMT
</span><span style="color: lime;">Server: Apache/2.2.15 (CentOS)
</span><span style="color: white;">Transfer-Encoding: chunked
Content-Type: message/http

TRACE / HTTP/1.1
</span><span style="color: lime;">User-Agent: curl/7.21.7 (x86_64-redhat-linux-gnu) libcurl/7.21.7 NSS/3.13.3.0 zlib/1.2.5 libidn/1.22 libssh2/1.2.7
</span><span style="color: white;">Host: www.linuxtutorial.net
Accept: */*</span></span></span></pre>
<div align="LEFT" style="font-weight: normal; margin-bottom: 0in; orphans: 1;">
<span style="color: black;"><span style="font-family: Georgia, Times New Roman, serif; font-size: large;">As
you can see, I am getting a response from the server for the TRACE
request. Now let us disable it.</span></span></div>
</h1>
<h2 align="LEFT" class="western" style="orphans: 1;">
<span style="color: #0b5394; font-size: x-large;"><u>Disabling TRACE support in Apache2</u></span></h2>
<h1 style="background-color: white; border: none; margin: 0px;">
<div align="LEFT" style="font-weight: normal; margin-bottom: 0in; orphans: 1;">
<span style="color: black;"><span style="font-family: Georgia, Times New Roman, serif; font-size: large;">To
switch off TRACE support, you need to open your main Apache2
configuration file which is here on my CentOS box:</span></span></div>
<pre class="western" style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 1px solid rgb(221, 221, 221); font-family: 'istok web', sans-serif; font-size: 18pt; line-height: 0.2in; margin-bottom: 0.16in; margin-top: 0.16in; orphans: 1; padding: 0.19in 0.21in;"><span style="font-family: "courier new", "courier", monospace;"><span style="font-size: medium;"><code class="western"><span style="color: white;">nano /etc/httpd/conf/</span><span style="color: lime;">httpd.conf</span></code></span></span></pre>
<div align="LEFT" style="font-family: 'istok web', sans-serif; font-weight: normal; margin-bottom: 0in; orphans: 1;">
<span style="color: black;"><span style="font-family: "georgia", "times new roman", serif;"><span style="font-size: large;">Now
add this directive to that file (I added it to the bottom of the
file):</span></span></span></div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-stretch: inherit; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline;"><span style="font-family: Courier New, Courier, monospace; font-size: medium;"><span style="line-height: 19px; white-space: pre-wrap;"><span style="color: lime;">TraceEnable </span><span style="color: white;">off</span></span></span></pre>
<div align="LEFT" style="font-family: 'istok web', sans-serif; font-weight: normal; margin-bottom: 0in; orphans: 1;">
<span style="color: black;"><span style="font-family: "georgia", "times new roman", serif;"><span style="font-size: large;">...and
restart Apache2:</span></span></span></div>
<pre style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 7px; border: 1px solid rgb(221, 221, 221); font-family: 'istok web', sans-serif; font-stretch: inherit; font-weight: normal; line-height: 19px; margin-bottom: 15px; margin-top: 15px; overflow-x: auto; overflow-y: hidden; padding: 18px 20px; vertical-align: baseline; white-space: pre-wrap;"><pre class="western" style="font-size: 18pt; font-weight: bold; line-height: 0.2in; orphans: 1;"><span style="font-family: "courier new", "courier", monospace;"><span style="font-size: medium;"><span style="color: white;">service </span><span style="color: lime;">httpd restart</span></span></span></pre>
</pre>
<div align="LEFT" style="font-family: 'istok web', sans-serif; font-weight: normal; margin-bottom: 0in; orphans: 1;">
<span style="color: black;"><span style="font-family: "georgia", "times new roman", serif;"><span style="font-size: large;">Now
when I run the same curl command again from my client machine, this
is the response I get:</span></span></span></div>
<pre class="western" style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 1px solid rgb(221, 221, 221); font-family: 'istok web', sans-serif; line-height: 0.2in; margin-bottom: 0.16in; margin-top: 0.16in; orphans: 1; padding: 0.19in 0.21in;"><span style="font-size: large;"><code class="western"><span style="color: white;"><span style="font-weight: normal;">$ curl -i -X TRACE http://www.linuxtutorial.net/</span></span></code>
<code class="western"><span style="color: white;"><span style="font-weight: normal;">HTTP/1.1 405 Method Not Allowed</span></span></code>
<code class="western"><span style="color: white;"><span style="font-weight: normal;">Date: Wed, 13 Feb 2013 14:30:32 GMT</span></span></code>
<span style="color: lime;"><code class="western"><span style="font-weight: normal;">Server: Apache/2.2.15 (CentOS)</span></code>
</span><code class="western"><span style="color: white;"><span style="font-weight: normal;">Allow: </span></span></code>
<code class="western"><span style="color: white;"><span style="font-weight: normal;">Content-Length: 223</span></span></code>
<code class="western"><span style="color: white;"><span style="font-weight: normal;">Content-Type: text/html; charset=iso-8859-1</span></span></code>

<span style="color: lime;"><code class="western"><span style="font-weight: normal;"><!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"></span></code>
</span><code class="western"><span style="color: white;"><span style="font-weight: normal;"><html><head></span></span></code>
<span style="color: lime;"><code class="western"><span style="font-weight: normal;"><title>405 Method Not Allowed</title></span></code>
</span><code class="western"><span style="color: white;"><span style="font-weight: normal;"></head><body></span></span></code>
<code class="western"><span style="color: white;"><span style="font-weight: normal;"><h1>Method Not Allowed</h1></span></span></code>
<code class="western"><span style="color: white;"><span style="font-weight: normal;"><p>The requested method TRACE is not allowed for the URL /.</p></span></span></code>
<span style="font-family: "courier new", "courier", monospace;"><code class="western"><span style="color: white;"><span style="font-weight: normal;"></body></html></span></span></code></span></span></pre>
<pre class="western" style="background-attachment: initial; background-clip: initial; background-color: #363636; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border: 1px solid rgb(221, 221, 221); font-family: 'istok web', sans-serif; line-height: 0.2in; margin-bottom: 0.16in; margin-top: 0.16in; orphans: 1; padding: 0.19in 0.21in;"><span style="font-size: large;"><span style="font-family: "courier new", "courier", monospace;"><code class="western"><span style="color: white;"><span style="font-weight: normal;"><a href="http://www.hackthesec.co.in/" target="_blank">www.hackthesec.co.in</a>
@hackthesecurity</span></span></code></span></span></pre>
</h1>
</div>
</div>
</div>

Disabling the TRACE method in Apache2

Disabling the TRACE method in Apache2 By default, Apache2 supports the HTTP TRACE method, which could expose your server to certain Cross-Site Scripting attacks. In this tutorial, I will show you how…

16 Feb 2016