101

• sending malicious requests using unexpected methods, which may lead to bypassing the web app controls.
• usually uses GET/POST. If the webapp allows other types, this could be exploitable
• 9 different verbs - https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods
• usual verbs:
  • 

Causes:

Insecure Configuration

• web config ONLY allows GET and POST requests "with authentication" to access the admin page.
• possibly: a "HEAD" request will be able to access without authentication.

Insecure Coding

• eg: an sql injection was found and the developer fixed the finding only for a GET request.
  • so the sqli can be exploited with a POST request.