HTTP Method Tampering is a type of security vulnerability that can be exploited in web apps, that occurs when an attacker manipulates the HTTP request method used to interact with a web server.
HTTP Request typically use methods like GET, POST, PUT, DELETE, OPTIONS, etc to perform specific actions on a web application.
Various situation and examples can be:
Changing a GET request to a DELETE request: if the application doesn't properly validate the method used, it might inadvertently delete data when we try to retrieving it.
Changing a POST request to a GET: it could expose sensitive data that should only be accessible via a POST request.
We can do it using Burp Repeater or Curl utility as below:
See allow method information -> curl -v <Target_URL>
And specify request options using -X (default is GET) -> curl -v -X OPTIONS <Target_URL>
Good new, more methods are allowed, then we can upload everything
curl <Target_URL>/uploads/ --upload-file shell.php
and open shell.php file uploaded into <Target_URL>/uploads/
