Understanding and exploiting HTTP for bug bounty

Whenever we want to make a request there are several methods to do it
based on what you want to do.

Here is the list.

In the example above I have used GET.

Note: HTTP/1.1 is the HTTP version used in the request and the 200 response means that everything went right.

Now let’s explain all methods.

1) GET

Probably the most used method.

GET is used almost for everything (except for logins usually)

For example when you search something on the web you are 99% probably using GET.

2) POST

As we mentioned above GET is not used for login because whenever we use GET the parameter are passed in the search bar.

But when you log into your bank account or in your e-mail sensitive information such username, password cannot be passed in the search bar.

So post is the same as GET except that all the URL parameter are not shown.

3) HEAD

This method is used when you want to show the headers in an HTTP request.

These are simple HTTP headers.

4) PUT

Probably the most dangerous HTTP methods.

PUT is used when you want to upload files on the server.

This method should be disabled.

Note: If the file is uploaded successfully the server will respond with 201 success (File uploaded)

5) DELETE

Another dangerous method.

This is used when you want to delete files on the server.

Note: If the file is deleted successfully the server will respond with 202 success (accepted)

6) Connect

Connect is used when you want to create a tunnel between you and server.

7) TRACE

This method in the past was used for debugging purpose.

When you use TRACE the server will respond with the exact request that you made, and it will prompt you to download a file that contain the saved request.

If enabled this method can be used to exploit XST (cross site tracing).

However, TRACE cannot be used in the modern browsers for security (apart Internet Explorer).

8) OPTIONS

OPTIONS is used when you want to know which HTTP methods are active on the server.

9) PATCH

PATCH is used when you want to modify something in your server.

For example the content of a file.