Nmap 6: Network Exploration and Security Auditing Cookbook

Listing supported HTTP methods

Web servers support different HTTP methods according to their configuration and software, and some of them could be dangerous under certain conditions. Pentesters need a way of quickly listing the available methods. The NSE script http-methods allows them not only to list these potentially-dangerous methods but also to test them.

This recipe shows you how to use Nmap to enumerate all of the HTTP methods supported by a web server.

How to do it...

Open a terminal and enter the following command:

$ nmap -p80,443 --script http-methods scanme.nmap.org

The results are shown for every web server detected on ports 80 or 443:

Nmap scan report for scanme.nmap.org (74.207.244.221)
Host is up (0.11s latency).
PORT STATE SERVICE ...