TRACE

• TRACE request method - HTTP | MDN

The HTTP TRACE method is a standard HTTP request method defined for performing a message loop-back test along the path to a target resource.

Role in Security and Attacks

The TRACE method is significant in security assessments and attacks primarily because of its interaction with intermediaries and its potential to disclose information:

1. Identifying Proxies and Network Infrastructure The HTTP TRACE method can be used by an attacker to detect any changes that a proxy server made to the request. By sending a TRACE request, the server is designed to return the exact request it received, often revealing proxy headers that intermediaries (like proxy servers or firewalls) have added. For example, the TRACE command response may reveal headers such as Via, X-Forwarded-For, and Proxy-Connection. This information can aid attackers in footprinting the web infrastructure and detecting the presence of Web Application Firewalls (WAFs) or proxy servers.

2. Vulnerability Scanning and Enumeration The TRACE method is often checked during web server footprinting and vulnerability scanning to see if it is enabled. Many web servers include TRACE among the allowed HTTP methods (e.g., OPTIONS, TRACE, GET, HEAD, POST). If this method is enabled, it may indicate a potential configuration vulnerability.

Detection

Attackers and security professionals use specialized tools and scripts to detect if a web server supports or uses the vulnerable TRACE method:

• Nmap Scripting Engine (NSE): The Nmap tool includes a dedicated script, http-trace, which is used to detect a vulnerable server that uses the TRACE method.
  • The command used to perform this check is typically: nmap --script http-trace -p80 localhost or nmap -p80 --script http-trace <host>.
• Manual Request: The TRACE command can be executed manually to probe HTTP servers and gather information. For example, sending a request starting with TRACE / HTTP/1.1 allows observation of the server's response.
• nikto: Vulnerability scanners like Nikto list TRACE among the allowed HTTP methods when reporting configuration findings.