Check if unneeded HTTP verbs (TRACE, TRACK, PUT, DELETE) are exposed or allow authentication filter bypasses.
Sends TRACE requests to check for Cross-Site Tracing (XST), tests X-HTTP-Method-Override headers, and evaluates preflight OPTIONS permissions.
Canonical test payload dispatched during security surface audits.
TRACE / HTTP/1.1Watch the probe engine test this signature in an isolated sandbox.
Disable TRACE in Nginx
# Default allows all methods
if ($request_method !~ ^(GET|HEAD|POST|PUT|DELETE|OPTIONS)$ ) {
return 405;
}Reject unexpected HTTP methods at the reverse proxy layer to protect against HTTP verb tunneling.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for HTTP Method Tampering & Verb Tunneling Scanner.
Checks commonly evaluated alongside HTTP Method Tampering & Verb Tunneling Scanner during surface discovery.
Detect SQL injection vulnerabilities in your web application before attackers exploit database access.
Find XSS vulnerabilities that could let attackers inject malicious scripts and steal customer sessions.
Detect exposed API keys, private tokens, and cloud secrets in client-side bundles and public responses.
Audit your site across all 41 vectors automatically on every deploy.