> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/ewptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/ewptv2-notes/readme/5.5-other-common-web-attacks/6.1-http-attacks/6.1.1-http-method-tampering.md).

# 6.1.1 HTTP Method Tampering

## HTTP Method Tampering

HTTP Method Tampering is a type of security vulnerability that can be exploited in web apps, that occurs when an attacker manipulates the HTTP request method used to  interact with a web server.

HTTP Request typically use methods like GET, POST, PUT, DELETE, OPTIONS, etc to perform specific actions on a web application.

### Examples of HTTP Method Tampering

Various situation and examples can be:

* Changing a GET request to a DELETE request: if the application doesn't properly validate the method used, it might inadvertently delete data when we try to retrieving it.
* Changing a POST request to a GET: it could expose sensitive data that should only be accessible via a POST request.

We can do it using Burp Repeater or Curl utility as below:

See allow method information -> `curl -v <Target_URL>`

And specify request options using -X (default is GET) -> `curl -v -X OPTIONS <Target_URL>`

<figure><img src="https://1357648772-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FesKkkNq5JVqzRLKWf4Ug%2Fuploads%2F3V1gRVCeu6GgJhjdsRj0%2Fimage.png?alt=media&amp;token=159a27bb-7d38-42d4-ba1a-15fd01641742" alt=""><figcaption></figcaption></figure>

Good new, more methods are allowed, then we can upload everything

`curl <Target_URL>/uploads/ --upload-file shell.php`

and open shell.php file uploaded into \<Target\_URL>/uploads/