Thomas Reinke <[EMAIL PROTECTED]> writes: > Note - this test also generated a fair number of false > positives in the past (was that fixed?) due to IIS servers > that had the PUT/DELETE methods respond as if they were > a GET request. Perhaps qualys is running afoul of that?
Well, there were not *exactly* false positive. The message said that the PUT and/or DELETE method were enabled and that it was safer to disable it. The problem is that you cannot do this with IIS: it just rely on the access control system to reject unauthenticated upload or deletion with a 403 code. You can enable back the old behaviour by setting "integrist test". (the comment in http_methods.nasl explains this) > Try contacting the server and issuing the request > DELETE /index.html HTTP/1.0 > (but only if its YOUR server) and see what it responds > back with. Another way is to run the Nessus test and look at what is happening with a good sniffer (Ethereal) - [EMAIL PROTECTED]: general discussions about Nessus. * To unsubscribe, send a mail to [EMAIL PROTECTED] with "unsubscribe nessus" in the body.
