TestInsecureHTTPVerbs.py scan failed with SocketTimeoutException

[flocurity]

Community script TestInsecureHTTPVerbs.py fails every time with the following stack :
java.net.SocketTimeoutException: java.net.SocketTimeoutException: Read timed out Traceback (most recent call last): File "<script>", line 69, in scanNode File "<script>", line 56, in TestTheURIForInsecureVerbs File "<script>", line 56, in TestTheURIForInsecureVerbs at java.net.SocketInputStream.socketRead0(Native Method) at java.net.SocketInputStream.read(Unknown Source) at java.net.SocketInputStream.read(Unknown Source) at java.io.BufferedInputStream.fill(Unknown Source) at java.io.BufferedInputStream.read(Unknown Source) at org.apache.commons.httpclient.HttpParser.readRawLine(HttpParser.java:78) at org.apache.commons.httpclient.HttpParser.readLine(HttpParser.java:106) at org.apache.commons.httpclient.HttpConnection.readLine(Unknown Source) at org.apache.commons.httpclient.MultiThreadedHttpConnectionManager$HttpConnectionAdapter.readLine(MultiThreadedHttpConnectionManager.java:1413) at org.apache.commons.httpclient.HttpMethodBase.readStatusLine(Unknown Source) at org.apache.commons.httpclient.HttpMethodBase.readResponse(Unknown Source) at org.apache.commons.httpclient.HttpMethodBase.execute(Unknown Source) at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(Unknown Source) at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(Unknown Source) at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397) at org.parosproxy.paros.network.HttpSender.executeMethod(Unknown Source) at org.parosproxy.paros.network.HttpSender.runMethod(Unknown Source) at org.parosproxy.paros.network.HttpSender.send(Unknown Source) at org.parosproxy.paros.network.HttpSender.sendAuthenticated(Unknown Source) at org.parosproxy.paros.network.HttpSender.sendAndReceive(Unknown Source) at org.parosproxy.paros.core.scanner.AbstractPlugin.sendAndReceive(Unknown Source) at org.zaproxy.zap.extension.ascan.ScriptsActiveScanner.sendAndReceive(Unknown Source) at org.parosproxy.paros.core.scanner.AbstractPlugin.sendAndReceive(Unknown Source) at org.zaproxy.zap.extension.ascan.ScriptsActiveScanner.sendAndReceive(Unknown Source) at sun.reflect.GeneratedMethodAccessor14.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) at java.lang.reflect.Method.invoke(Unknown Source)

This happens on every site I've tested, included those in the comments like http://crackme.cenzic.com . By the way, It fails everytime on the TRACE method.

[flocurity]

After debugging a little, I've found that the method TRACE alone works.
So I've changed the order of the insecureverbs array to insert TRACE after HEAD and it works ! I'll create a pull request, but I'm curious about if that issue happens to others than me.

[thc202]

Did you try increase the connection timeout? [1]

[1] https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsConnection

[flocurity]

I did it - from 20 seconds to 60 - and the same error occurs

[thc202]

Odd, I'm not seeing the timeout with the examples in the comment or with other servers.

[flocurity]

I thought that it could be 'cause of the proxy my company uses. So i've tried to bypass it with unchecking in Options and scanning a local app, the same error occurs. Weird !

[flocurity]

If I'm the only one impacted, you can drop my pull request, I'll update the script on my systems when needed.

[thc202]

Feel free to open the pull request anyway, if that fixes the issue then great (the order does not matter much, or shouldn't).