Identifying supported HTTP methods with Burp Suite - Port Swigger
Summary: PortSwigger notes that misconfiguration can leave websites supporting additional HTTP methods useful to an attacker, and that some sites ignore the method entirely and respond the same way to an arbitrary, non-standard method. The most reliable way to identify supported methods is to send a request with each candidate method and observe the response, a process Burp Intruder can automate, since an OPTIONS request often returns misleading or incomplete information.
What's compelling: A server that answers the same way to a non-standard method can let an attacker bypass WAFs, weak input filters, and some cross-site defenses, and inconsistent handling across endpoints maintained by different teams means a single test will not tell you what the whole site supports.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026