Which Nmap NSE script helps detect HTTP methods available on a web server?

Which Nmap NSE script helps detect HTTP methods available on a web server?

• A. http-info
• B. http-methods-check
• C. http-methods
• D. http-method

Answer: (C)

Understanding which HTTP methods a web server supports is a common way to assess its security posture. The Nmap NSE script that does this is the one that specifically enumerates allowed HTTP methods by querying the server and inspecting its responses. It typically sends an OPTIONS request and examines the response, especially the Allow header, to build a list of methods the server accepts, such as GET, POST, PUT, DELETE, PATCH, OPTIONS, and TRACE. It can also highlight methods that are considered risky to have enabled, like PUT or DELETE, which could allow file uploads or deletions if not properly restricted. This kind of check helps you spot misconfigurations or overly permissive settings that could be exploited. Other scripts in the set have different focuses. One provides general HTTP server information and banner details rather than a method list. Another checks whether particular methods are allowed, but it isn’t the comprehensive enumeration that the dedicated method-detection script performs. The remaining options are variants that don’t specifically offer the same full-method discovery capability. So, the script that performs the HTTP methods enumeration is the best fit for detecting which methods a web server supports.

Understanding which HTTP methods a web server supports is a common way to assess its security posture. The Nmap NSE script that does this is the one that specifically enumerates allowed HTTP methods by querying the server and inspecting its responses. It typically sends an OPTIONS request and examines the response, especially the Allow header, to build a list of methods the server accepts, such as GET, POST, PUT, DELETE, PATCH, OPTIONS, and TRACE. It can also highlight methods that are considered risky to have enabled, like PUT or DELETE, which could allow file uploads or deletions if not properly restricted. This kind of check helps you spot misconfigurations or overly permissive settings that could be exploited.

Other scripts in the set have different focuses. One provides general HTTP server information and banner details rather than a method list. Another checks whether particular methods are allowed, but it isn’t the comprehensive enumeration that the dedicated method-detection script performs. The remaining options are variants that don’t specifically offer the same full-method discovery capability. So, the script that performs the HTTP methods enumeration is the best fit for detecting which methods a web server supports.