Skip to content
HackIndex logo

HackIndex

WebDAV Enumeration and Vulnerability Testing

3 min read Mar 28, 2026

WebDAV extends HTTP with file management methods including PUT, PROPFIND, MKCOL, MOVE, and DELETE. When enabled on a web server, it creates an upload surface that can be abused to plant web shells or access files. Confirm which methods are allowed and whether authentication is enforced before moving to WebDAV exploitation.

Detect WebDAV via OPTIONS

OPTIONS returns which HTTP methods the server accepts. DAV-specific methods in the Allow header confirm WebDAV is active:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X OPTIONS -i http://$TARGET_IP:$PORT/ 
HTTP/1.1 200 OK
Allow: OPTIONS,GET,HEAD,POST,PUT,DELETE,MKCOL,PROPFIND,PROPPATCH,COPY,MOVE,LOCK,UNLOCK
DAV: 1,2
MS-Author-Via: DAV

The presence of PROPFIND, MKCOL, PUT, or MOVE in the Allow header confirms WebDAV. The DAV: header confirms compliance level. Check specific directories too — DAV is sometimes enabled only on certain paths:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X OPTIONS -i http://$TARGET_IP:$PORT/webdav/

PROPFIND for Directory Listing

PROPFIND lists the contents of a collection. A 207 Multi-Status response means the listing worked and you can see what files exist:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X PROPFIND http://$TARGET_IP:$PORT/ -H 'Depth: 1' -H 'Content-Type: text/xml' --data-binary '<?xml version="1.0"?><propfind xmlns="DAV:"><allprop/></propfind>' -i 
HTTP/1.1 207 Multi-Status

<?xml version="1.0"?>
<D:multistatus xmlns:D="DAV:">
  <D:response>
    <D:href>/uploads/</D:href>
  </D:response>
</D:multistatus>

207 Multi-Status confirms unauthenticated listing. This reveals file and directory structure, which is useful for identifying existing content and planning what to upload. A 401 means DAV exists but requires credentials — worth checking credential reuse from elsewhere in scope.

Test Unauthenticated PUT

Confirm whether files can be uploaded without credentials. Use a benign test file and a non-executable extension first to measure the response:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X PUT http://$TARGET_IP:$PORT/test.txt -d 'webdav_test' -i 
HTTP/1.1 201 Created

201 Created confirms unauthenticated file upload. This is the key finding — an unauthenticated PUT to a web-accessible path enables web shell upload. Move to WebDAV exploitation.

davtest for Automated Upload Testing

davtest tests which file extensions can be uploaded and executed. It tries multiple types and reports which succeed:

┌──(kali㉿kali)-[~]
└─$ davtest -url http://$TARGET_IP:$PORT/ 
********************************************************
 Testing DAV connection
OPEN		SUCCEED:  http://10.10.10.50
********************************************************
Creating directory
MKCOL		SUCCEED:  Created http://10.10.10.50/DavTestDir_abc123
********************************************************
Sending test files
PUT	php	SUCCEED:  http://10.10.10.50/DavTestDir_abc123/davtest_abc123.php
PUT	txt	SUCCEED:  http://10.10.10.50/DavTestDir_abc123/davtest_abc123.txt
********************************************************
Checking for test file execution
EXECUTE	php	SUCCEED:  http://10.10.10.50/DavTestDir_abc123/davtest_abc123.php

EXECUTE success on PHP confirms you can upload and execute server-side code. This is a direct path to a web shell. If PHP execution fails but txt succeeds, check whether MOVE can rename a .txt to .php after upload — this is a common bypass on IIS/WebDAV configurations.

cadaver Interactive Check

cadaver provides an interactive WebDAV client. Useful for quick manual exploration when you want to browse the collection:

┌──(kali㉿kali)-[~]
└─$ cadaver http://$TARGET_IP:$PORT/ 
dav:/> ls
Listing collection `/': succeeded.
        uploads/       May 12 10:23

If cadaver connects and ls works without credentials, you have unauthenticated WebDAV listing. If prompted for credentials, try common defaults: wampp:xampp, admin:admin, $USER:$PASSWORD from other services in scope.

References