Dopo aver svuotato Cross Site Tracing , ho scansionato uno dei nostri siti con lo strumento FOCA. Questo è tornato con diverse pagine / file sul nostro sito con il messaggio Insecure methods found (trace) on ... :
Questomihalasciatoconfuso,comunque,perchéusiamoCloudflareepensavocheTRACEfossedisabilitato.Infatti,quandoprovoconcurl:
[user@host~]#curl-v-XTRACEhttp://www.domain.tld*Abouttoconnect()towww.domain.tldport80(#0)*Trying12.34.56.78...connected*Connectedtowww.domain.tld(12.34.56.78)port80(#0)>TRACE/HTTP/1.1>User-Agent:curl/7.19.7(x86_64-redhat-linux-gnu)libcurl/7.19.7NSS/3.21BasicECCzlib/1.2.3libidn/1.18libssh2/1.4.2>Host:www.domain.tld>Accept:*/*><HTTP/1.1405NotAllowed<Date:Tue,14Feb201712:21:55GMT<Content-Type:text/html<Content-Length:177<Connection:close<Server:-nginx<CF-RAY:-<<html><head><title>405NotAllowed</title></head><bodybgcolor="white">
<center><h1>405 Not Allowed</h1></center>
<hr><center>cloudflare-nginx</center>
</body>
</html>
* Closing connection #0
[user@host ~]# curl -v -X TRACE https://www.domain.tld
* About to connect() to www.domain.tld port 443 (#0)
* Trying 12.34.56.78... connected
* Connected to www.domain.tld (12.34.56.78) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* SSL connection using TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
* Server certificate:
* subject: CN=ssl376438.cloudflaressl.com,OU=PositiveSSL Multi-Domain,OU=Domain Control Validated
* start date: Jan 08 00:00:00 2017 GMT
* expire date: Jul 16 23:59:59 2017 GMT
* common name: ssl376438.cloudflaressl.com
* issuer: CN=COMODO ECC Domain Validation Secure Server CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
> TRACE / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.21 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: www.domain.tld
> Accept: */*
>
< HTTP/1.1 405 Not Allowed
< Server: cloudflare-nginx
< Date: Tue, 14 Feb 2017 12:22:06 GMT
< Content-Type: text/html
< Content-Length: 177
< Connection: close
< CF-RAY: -
<
<html>
<head><title>405 Not Allowed</title></head>
<body bgcolor="white">
<center><h1>405 Not Allowed</h1></center>
<hr><center>cloudflare-nginx</center>
</body>
</html>
* Closing connection #0
Ho provato quanto sopra per tutti gli URL nel rapporto, sia su HTTP / HTTPS, ma ottengo sempre lo stesso errore 405 (previsto).
Perché l'FOCA dovrebbe segnalare le vulnerabilità della traccia?
Aggiornamento: quando eseguo una query per OPTIONS , mi sembra di ottenere solo la risposta standard, come se fosse un get. Ho provato in diversi modi (curl, netcat, nmap) ma questo è ciò che viene restituito:
[user@host ~]# curl -X OPTIONS -s -D - www.domain.tld -o /dev/null
HTTP/1.1 200 OK
Date: Wed, 15 Feb 2017 09:48:45 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d4f940f3903e1c8ea83cc23653023dde41487152125; expires=Thu, 15-Feb-18 09:48:45 GMT; path=/; domain=.domain.tld; HttpOnly
X-Powered-By: PHP/7.0.15
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: PHPSESSID=jakcc66bq3s3cta6e3q9vfj7j5; expires=Sat, 18-Feb-2017 09:48:45 GMT; Max-Age=259200; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Set-Cookie: SERVERID=WEB1; path=/
Server: cloudflare-nginx
CF-RAY: 3322d890c7260cb9-LHR
[user@host ~]# nmap -p 80 --script http-methods www.domain.tld
Starting Nmap 5.51 ( http://nmap.org ) at 2017-02-15 11:17 GMT
Nmap scan report for www.domain.tld (104.25.161.34)
Host is up (0.016s latency).
Other addresses for www.domain.tld (not scanned): 104.25.160.34
PORT STATE SERVICE
80/tcp open http
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
Nmap done: 1 IP address (1 host up) scanned in 11.21 seconds