description:
WEBDAV is an extended protocol based on HTTP 1.1. It supports uploading and locking files using the PUT method. Based on this feature, a powerful content or configuration management system can be realized. However, rich features will always bring more hidden dangers to security, especially in the case of improper configuration, may directly leave an entry for the attacker to upload files. davtest is a file upload vulnerability detection and verification tool, and cadaver, as a WEBDAV client program in the form of a command line, can perform any operations on the corresponding server. In this lesson, I combined the above two tools to upload the forward and reverse WEBSHELL to the server respectively, so as to finally realize the remote control of the target server.
Options:
-auth+
授权(用户:密码)
-cleanup
完成后删除所有上传的内容
-directory+
要创建的目录的后缀部分
-debug+
DAV调试级别1-3（将2和3日志请求/响应复制到/tmp/perldav_debug.txt）
-move
放置文本文件，然后移动到可执行文件
-nocreate
不要创建目录
-quiet
仅打印摘要
-rand+
使用它代替文件名的随机字符串
-sendbd+
发送后门:
自动-用于任何成功的测试
ext-后门/目录中与文件名匹配的扩展名
-uploadfile+
上传此文件（需要-uploadloc）
-uploadloc+
将文件上传到此位置/名称（需要-uploadfile）
-url+
DAV位置的url
Clear layout ( https://www.bilu.asia/tool/tools.php?doc=davtest )
Note: For more information about kali, please follow the official account (bilu), or visit the personally built kali site, Bilu ( https://www.bilu.asia )
At the same time, you can also directly visit https://mobile.yangkeduo.com/goods.html?goods_id=209567782598 to get kali related information one step in advance.
Next, a kali-related document will be released every day, so stay tuned.