bruteoptions.py — Get allowed HTTP Methods for a list of directories
A recent email by Dave Aitel to the Dailydave mailing list on Pen testing web servers was an inspiration to publishing a short, but simple script. I like to keep things simple when I write scripts, taking the Unix philosophy of doing one thing and doing it well.
bruteoptions.py takes two arguments: 1) a FQDN of a known site, and 2) a file with directory names. The script runs through and performs an OPTIONS HTTP Request for each directory name in the file. In the past, I’ve used a combination of directories I’ve identified while browsing/spidering a website through Burp, and the other partly a dictionary list taken from a tool like OWASP DirBuster.
Using the tool is simple, just specify the site FQDN to scan and give it a file as a second argument.
$ ./bruteoptions.py
./gethttpoptions.py <url> <list of directories>
$ ./bruteoptions.py tssci-security.com dirs
“tssci-security.com”,”/about/”,”200 OK”,”Apache/1.3.39 (Unix)”,”None”
“tssci-security.com”,”/upload/”,”200 OK”,”Apache/1.3.39 (Unix)”,”GET, HEAD, OPTIONS, TRACE”
“tssci-security.com”,”/projects/”,”200 OK”,”Apache/1.3.39 (Unix)”,”None”
An interesting thing I’ve just noticed, is the lack of allowed methods returned for a virtual directory, versus an actual directory when run against my site. If anyone cares to comment about this, I’d be interested to know what is the cause.
You can download the script from the bruteoptions.py project page.
I have found that OPTIONS will show TRACE enabled on IIS 6.0/7.0 even when it is disabled by default in these versions - however, the TRACK method might be enabled and does not show in OPTIONS.
http://blog.techstacks.com/2008/07/disabling-trace-method-in-iis.html
Do you have any favorite tools when it comes to making a directory list/spidering a web application?
I usually use Burp and then do some tweaking/scripting with the found URL:s which I copy out of Burp.
But are the tools that automatically makes a directory list when spidering?
Hey Alex, I wrote a Python script to do this for me.
dir_expand.py
What the script does, is it would take a deep URL, and break it up into individual lines, as so:
i.e.,
$ cat spidered_urls/deep/nested/directory/url/structure/index.php
$ ./dir_expand.py spidered_urls/deep/
/deep/nested/
/deep/nested/directory/
/deep/nested/directory/url/
/deep/nested/directory/url/structure/