Re: Disable TRACE IIS 6

On Dec 7, 2:16 am, Rob <R...@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
We have had results from a pen test and they state that we have TRACE HHTP
enabled and also the OPTIONS request returns GET, HEAD, POST, PUT,
DELETE,TRACE, OPTIONS, CONNECT

We have disabled TRACE via the registry (EnableTraceMethod = 0)
I have installed urlscan and allowed only GET, HEAD, POST verbs
I've got into the home directory > configuration for the root, default and
each virutal site and edited each extension so that only GET, HEAD and POST
are allowed

We do not use WebDAV - prohibited and only use ASP

However, using Nesses, netcat and wfetch all return the same:
OPTIONS still show GET, HEAD, POST, PUT, DELETE,TRACE, OPTIONS, CONNECT
TRACE / HTTP/1.0 still returns a 200 OK and not a 501
PUT /../..HTTP/1.0 returns a 403 forbidden tho I am unsure whether that
matters or not?

Any ideas? Is thois a false positve?
Thanks


Return value of OPTIONS is static so you can ignore it.

URLScan will reject PUT with 404 if it is running so it looks like
URLScan is not running on your system as you think.

TRACE has special code in IIS that skips over URLScan's attempt to
reject it, so EnableTraceMethod=0 is the only way. Are you sure your
TRACE actually worked to reveal anything after you set the registry
key because simply returning 200 doesn't mean there's a problem...

Consider the security setting of Known Extensions -- IIS returns 404
for disabled extensions or unknown file extensions even if the file
exists -- because to do anything else gives away information.
Likewise, if OPTIONS and TRACE start doing different things by
configuration, it gives away information...


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//
.

Relevant Pages

  • Re: Disable trace and track verbs
    ... OPTIONS, TRACE, GET, HEAD, POST\r\n ... by default option is not allow in urlscan [allowverbs] section. ... >>my web site to trace and track commands. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Languages of Africa
    ... Without a trace, ... Taxonomy and Genetic Relationships Between Indo-Pacific Languages ... he has managed to resolve the consonantal correspondences of the ... Halmaheran, South Bird’s Head, West Bomberai, Nimboran and Upper Tami ...
    (sci.lang)
  • Re: Disable trace and track verbs
    ... I understand what u are saying, but URLscan will not ... intercept that command yet as IIS will still respond to ... an OPTIONS and TRACE command even with it disabled. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Disable TRACE IIS 6
    ... The odd thing about the OPTIONS values are that on our dev server the ... response is only TRACE, GET, HEAD and when I do a TRACE I get the 501 ...
    (microsoft.public.inetserver.iis.security)
  • Re: How do I verify that WebDAV is disabled?
    ... Here is an> example from a server with no IISLockdown/URLScan and with> WebDAV enabled: ... OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH,> LOCK, UNLOCK ...
    (microsoft.public.inetserver.iis.security)