CEH Web Application and Injection Attacks Practice Question
A penetration tester is testing an IIS web server and wants to exploit a WebDAV misconfiguration to upload a web shell. Which HTTP method should the tester check to determine if WebDAV is enabled and allows file uploads?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OPTIONS
The OPTIONS method queries the server for supported HTTP methods. If WebDAV is enabled, the response will include methods like PUT, DELETE, PROPFIND, etc. PUT is used for upload, but OPTIONS first confirms availability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
OPTIONS
Why this is correct
The HTTP OPTIONS method is specifically designed to query a web server or resource about the communication options supported by the server for that particular URL. It provides a list of allowed HTTP methods (e.g., GET, HEAD, POST, PUT, DELETE, TRACE, CONNECT) in the 'Allow' header of its response. This is crucial for a penetration tester to discover if potentially vulnerable methods like PUT (for file upload) or WebDAV methods are enabled before attempting to exploit them.
- ✗
MOVE
Why it's wrong here
The HTTP MOVE method is a WebDAV extension that instructs the server to move a resource from one URI to another. While its presence might indicate WebDAV is enabled, its primary function is resource manipulation, not method discovery. Sending a MOVE request directly would attempt to perform a file operation, which is not the initial reconnaissance step needed to determine *which* methods are permitted on the server.
- ✗
PUT
Why it's wrong here
The HTTP PUT method is used to upload a representation of the specified URI. A penetration tester might eventually use PUT to upload malicious files if allowed, but attempting a PUT request without prior knowledge of its enablement is premature. The server would likely return a "405 Method Not Allowed" or "403 Forbidden" error if PUT is disabled, failing to provide the desired information about *all* allowed methods.
- ✗
PROPFIND
Why it's wrong here
The HTTP PROPFIND method is another WebDAV extension used to retrieve properties, such as author, creation date, or content type, from a resource or collection. While it can reveal information about the resource itself and its WebDAV capabilities, it does not directly return the list of *allowed HTTP methods* for that URI in a standard 'Allow' header. Its purpose is property retrieval, not method enumeration.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.