# WebDAV Enumeration and Vulnerability Testing

- **URL:** https://hackindex.io/services/web/vulnerability-discovery/webdav-enumeration
- **Path:** HTTP/HTTPS > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/web/vulnerability-discovery.md)
- **Published:** 2026-01-23
- **Updated:** 2026-03-28

WebDAV extends HTTP with file management methods including PUT, PROPFIND, MKCOL, MOVE, and DELETE. When enabled on a web server, it creates an upload surface that can be abused to plant web shells or access files. Confirm which methods are allowed and whether authentication is enforced before moving to [WebDAV exploitation](https://hackindex.io/services/web/exploitation/webdav-exploitation).

- **OPTIONS detection** checks the Allow header for DAV-specific methods like PUT, PROPFIND, and MOVE.
- **PROPFIND directory listing** enumerates files and directories with a 207 Multi-Status response.
- **Unauthenticated PUT test** confirms whether files can be uploaded without credentials.
- **davtest automated scanning** tests which file extensions can be uploaded and executed.
- **cadaver interactive client** provides manual browsing and upload verification.

## Detect WebDAV via OPTIONS

OPTIONS returns which HTTP methods the server accepts. DAV-specific methods in the Allow header confirm WebDAV is active:

```bash
curl -sk -X OPTIONS -i http://$TARGET_IP:$PORT/
# HTTP/1.1 200 OK
# Allow: OPTIONS,GET,HEAD,POST,PUT,DELETE,MKCOL,PROPFIND,PROPPATCH,COPY,MOVE,LOCK,UNLOCK
# DAV: 1,2
# MS-Author-Via: DAV
```

The presence of `PROPFIND`, `MKCOL`, `PUT`, or `MOVE` in the Allow header confirms WebDAV. The `DAV:` header confirms compliance level. Check specific directories too: DAV is sometimes enabled only on certain paths:

```bash
curl -sk -X OPTIONS -i http://$TARGET_IP:$PORT/webdav/
```

## PROPFIND for Directory Listing

PROPFIND lists the contents of a collection. A 207 Multi-Status response means the listing worked and you can see what files exist:

```bash
curl -sk -X PROPFIND http://$TARGET_IP:$PORT/ -H 'Depth: 1' -H 'Content-Type: text/xml' --data-binary '<?xml version="1.0"?><propfind xmlns="DAV:"><allprop/></propfind>' -i
# HTTP/1.1 207 Multi-Status
#
# <?xml version="1.0"?>
# <D:multistatus xmlns:D="DAV:">
#   <D:response>
#     <D:href>/uploads/</D:href>
#   </D:response>
# </D:multistatus>
```

207 Multi-Status confirms unauthenticated listing. This reveals file and directory structure, which is useful for identifying existing content and planning what to upload. A 401 means DAV exists but requires credentials: worth checking credential reuse from elsewhere in scope.

## Test Unauthenticated PUT

Confirm whether files can be uploaded without credentials. Use a benign test file and a non-executable extension first to measure the response:

```bash
curl -sk -X PUT http://$TARGET_IP:$PORT/test.txt -d 'webdav_test' -i
# HTTP/1.1 201 Created
```

201 Created confirms unauthenticated file upload. This is the key finding: an unauthenticated PUT to a web-accessible path enables web shell upload. Move to [WebDAV exploitation](https://hackindex.io/services/web/exploitation/webdav-exploitation).

## davtest for Automated Upload Testing

davtest tests which file extensions can be uploaded and executed. It tries multiple types and reports which succeed:

```bash
davtest -url http://$TARGET_IP:$PORT/
# ********************************************************
#  Testing DAV connection
# OPEN		SUCCEED:  http://10.10.10.50
# ********************************************************
# Creating directory
# MKCOL		SUCCEED:  Created http://10.10.10.50/DavTestDir_abc123
# ********************************************************
# Sending test files
# PUT	php	SUCCEED:  http://10.10.10.50/DavTestDir_abc123/davtest_abc123.php
# PUT	txt	SUCCEED:  http://10.10.10.50/DavTestDir_abc123/davtest_abc123.txt
# ********************************************************
# Checking for test file execution
# EXECUTE	php	SUCCEED:  http://10.10.10.50/DavTestDir_abc123/davtest_abc123.php
```

EXECUTE success on PHP confirms you can upload and execute server-side code. This is a direct path to a web shell. If PHP execution fails but txt succeeds, check whether MOVE can rename a .txt to .php after upload: this is a common bypass on IIS/WebDAV configurations.

## cadaver Interactive Check

cadaver provides an interactive WebDAV client. Useful for quick manual exploration when you want to browse the collection:

```bash
cadaver http://$TARGET_IP:$PORT/
# dav:/> ls
# Listing collection `/': succeeded.
#         uploads/       May 12 10:23
```

If cadaver connects and `ls` works without credentials, you have unauthenticated WebDAV listing. If prompted for credentials, try common defaults: `wampp:xampp`, `admin:admin`, `$USER:$PASSWORD` from other services in scope.

## References

- [davtest](https://github.com/cldrn/davtest) - WebDAV server testing for upload and execution capabilities
- [cadaver](https://notroj.github.io/cadaver/) - Interactive WebDAV client for manual collection browsing