Probing Dangerous HTTP Methods

Overview

Most HTTP methods beyond GET/POST/HEAD are vestigial — leftover from WebDAV authoring stacks of the early 2000s, debugging features in legacy servers, or default-enabled methods nobody disabled at install time. Each enabled method that the application doesn't use is an attack surface: TRACE enables Cross-Site Tracing (XST), PUT enables arbitrary file upload to unprotected paths, CONNECT enables proxy abuse against internal services, WebDAV enables directory manipulation.

This skill probes the canonical method set and grades each based on its presence and response.

When the skill produces findings