WebDAV enumeration & misconfiguration

WebDAV, or Web Distributed Authoring and Versioning, is an extension of HTTP that allows clients to remotely manage files and directories on a web server. It adds methods for creating, modifying, moving and deleting web resources.

The presence of WebDAV does not by itself indicate a vulnerability. The security impact depends on authentication, enabled methods, filesystem permissions and whether users can create or modify sensitive resources.

Start by identifying the underlying HTTP service and then determine whether WebDAV methods are enabled.

OPTIONS can reveal which HTTP methods the server advertises for a resource. WebDAV-enabled servers may expose methods beyond normal GET and POST operations.

WebDAV introduces methods such as PROPFIND, MKCOL, COPY, MOVE, LOCK and UNLOCK. PUT and DELETE are also particularly important when assessing whether a location is writable.

PROPFIND requests metadata about a WebDAV resource and can enumerate files, directories and properties exposed by the server.

PUT requests creation or replacement of a resource. If an unauthorised user can successfully upload files into a sensitive web-accessible directory, the configuration may be security-relevant.

DELETE removes a resource when permitted. When testing write permissions, use only harmless files created specifically for the assessment.

MKCOL creates a new collection, which is similar to creating a directory in WebDAV.

WebDAV may be protected by HTTP Basic, Digest, NTLM or other authentication mechanisms. Authentication requirements should be identified before testing write access.

DAVTest automates several WebDAV capability checks and can test which file types the server allows to be uploaded or executed in a writable WebDAV location.

DAVTest can help identify writable resources, supported extensions and whether uploaded test files are accessible. Its output should be interpreted together with server permissions and application behaviour.

Cadaver is an interactive command-line WebDAV client. It provides a workflow similar to FTP clients for browsing, uploading, downloading and managing WebDAV resources.

Once connected, Cadaver can enumerate directories and transfer files when the authenticated account has the required permissions.

A writable WebDAV location becomes more important when uploaded files are stored in a web-accessible path or processed by another application. Write access alone does not automatically imply code execution.

WebDAV has historically been deployed with Microsoft IIS, but it is not limited to IIS. During enumeration, identify the underlying web server and determine how WebDAV permissions interact with the web root and authentication configuration.

Nmap includes scripts that can help identify WebDAV functionality and supported HTTP methods.

When testing write permissions, create a harmless file specifically for the assessment and remove it afterward. Avoid modifying or deleting existing application files.

Identify the web service, enumerate supported HTTP methods, test PROPFIND, determine whether authentication is required, inspect accessible resources and then assess read and write permissions using DAVTest, Cadaver or manual requests.

These are the WebDAV commands worth remembering.