Skip to main content
WebDAV extends plain HTTP with methods for creating, moving, and deleting files directly on a web server (PUT, MOVE, COPY, PROPFIND, DELETE, among others). It rides on the same ports as the regular web server, 80 and 443, which means a misconfigured WebDAV endpoint is effectively an unauthenticated (or weakly authenticated) file upload into the webroot, often a straight line to remote code execution.
WebDAV is most commonly found bolted onto IIS or Apache rather than running as its own standalone service. Fingerprinting it is really about spotting which HTTP methods a given path accepts.

Enumeration

Finding WebDAV-enabled paths and working out which methods (PUT, MOVE, etc.) the server actually allows.

Exploitation

Using PUT/MOVE to drop a webshell into the webroot and get it to execute, usually by working around an extension filter.

​
Discovering WebDAV Paths

WebDAV isn’t always mounted at an obvious path. These are worth checking first, ideally folded into a directory fuzzing pass (see Directory & Subdomain Fuzzing) rather than guessed one at a time.

​
Enumeration

A WebDAV-specific Nmap script checks directly for WebDAV support and misconfigurations.
OPTIONS is the fastest manual check, the server’s response lists exactly which HTTP methods it accepts on that path. Seeing PUT, MOVE, or DELETE in the Allow header is the signal to dig further.
PROPFIND lists the contents of a WebDAV directory, equivalent to a directory listing for a share you don’t otherwise have browse access to.
DAVTest automates checking which file extensions a server will actually let you upload and execute, far faster than testing one extension at a time by hand.
DAVTest can also test the MOVE-based extension bypass automatically with -move -sendbd auto, worth running whenever direct PUT with an executable extension gets blocked.

​
Authentication

WebDAV endpoints are frequently either unauthenticated or protected with weak, reused credentials, worth a brute force pass before assuming it’s locked down.
Apache WebDAV setups commonly store their credentials in /etc/apache2/users.password (htpasswd format). If you get local file read or access to the box through another vector, check there, the hashes can often be cracked or the file directly edited with htpasswd if you have write access.

​
File Upload and Execution

Cadaver gives you an interactive WebDAV session, closer to an FTP client, good for browsing and moving multiple files around.
Inside the session:

​
Bypassing Extension Filters

If the server blocks a direct .asp/.aspx/.php upload, uploading as a harmless extension first and renaming with MOVE after the fact often slips past a filter that only checks the extension at upload time, not at rename time.
IIS 5/6 has a well-known quirk: a request for shell.asp;.txt gets parsed and executed as .asp by the ASP handler, while the trailing ;.txt is enough to slip past a naive extension blocklist that only checks the end of the filename. Upload as .txt, then MOVE to the semicolon variant:

​
Metasploit

Automates the upload-and-execute chain against vulnerable IIS/WebDAV targets, handy once you’ve already confirmed PUT access works manually.

​
Quick Reference Tools

Hackviser: WebDAV

Reference used for this page.

HackTricks: PUT Method / WebDAV

Deeper dive into the PUT/MOVE extension bypass tricks and IIS specifics.

davtest

Automates testing which uploaded extensions actually execute.

cadaver

Interactive command-line WebDAV client.
Only test WebDAV upload/execution against targets explicitly in scope, dropping a webshell is active exploitation, not enumeration, and leaves a very obvious artifact on the target’s filesystem.