Posts on: Http

---

HTTP verb tampering exploits web servers and frameworks that treat HTTP methods inconsistently — a path that returns 403 on GET might return 200 on POST, PUT, or an obscure WebDAV method. The attack works by sending a request with an unexpected method to bypass authorization checks, security filters, or middleware that was only written for GET and POST. The core problem is that many access-control configurations are method-specific. A rule like <Limit GET POST> require valid-user </Limit> in Apache protects only those two verbs; every other method — HEAD, OPTIONS, PUT, DELETE, PATCH, or an invented verb — reaches the handler without authentication.