davtest: Tests WebDAV servers for vulnerabilities

When I first started digging into WebDAV misconfigurations during penetration tests, I kept running into the same problem — most web vulnerability scanners simply don’t know what to do with WebDAV’s PUT, MOVE, and COPY methods. That’s where DavTest comes in. It’s a small, purpose-built Perl tool that does one job extremely well: it checks whether a WebDAV-enabled server will let you upload files, and more importantly, whether it will let you execute them.

In this article I’m going to walk through what DavTest actually does under the hood, how to install and run it, how to read its output, and how I use it in real authorized engagements to identify exploitable file upload paths on WebDAV shares.

What Is DavTest?

DavTev tests a WebDAV server by attempting to PUT files of different extensions (.txt, .php, .asp, .jsp, .cfm, .pl, .html, etc.) into the target directory, then tries to access each uploaded file over HTTP to see which ones the server actually executes rather than just serving as static content.

The logic is simple but effective:

1. Upload a small test file per extension.
2. Request that file back over HTTP.
3. Compare the response — did the server return the raw source, execute it, or reject the upload entirely?
4. Report which extensions are “uploadable” and which are additionally “executable.”

This distinction matters a lot in real assessments. A server might happily accept a .txt upload but strip or reject .php — or it might accept everything, including live server-side scripts, which is a critical finding.

How It Works Internally

DavTest is written in Perl and relies on the HTTP::DAV module to speak WebDAV natively rather than shelling out to curl. Internally it:

• Creates a randomized directory name on the target (to avoid collisions and make cleanup easier).
• Iterates through a built-in list of file extensions, generating a minimal payload for each (usually just enough content to prove code execution, like a marker string).
• Uses WebDAV’s MKCOL method to create the test directory, PUT to upload each file, and GET to retrieve it.
• Optionally uses DELETE to clean up afterward.

Because it uses the DAV protocol directly instead of ordinary HTTP form uploads, it correctly exercises the exact attack surface that a real WebDAV client (like Windows Explorer’s “Map Network Drive” or cadaver) would use.

Installation

DavTest ships by default in Kali Linux. On other Debian-based distributions:

sudo apt update
sudo apt install davtest

To confirm it’s installed:

davtest --help

If you need to build from source (it’s a single Perl script), you can pull it from the Kali tools repository and just run it directly with perl davtest.pl, provided libhttp-dav-perl is installed:

sudo apt install libhttp-dav-perl

Basic Syntax

davtest -url <target_url>

Common flags I use:

Flag	Purpose
-url	Target WebDAV URL (required)
-auth <user>:<pass>	Basic auth credentials
-cleanup	Delete uploaded test files afterward
-move	Also try COPY/MOVE methods for evasion (bypasses extension filtering on some servers)
-uploadfile <path>	Upload a specific file instead of the built-in test set
-uploadloc <name>	Custom name for the uploaded file
-sendbd <ext1,ext2>	Restrict testing to specific extensions

Example Run

davtest -url http://192.168.56.101/webdav/

Sample output I’ve seen in a lab environment:

********************************************************
 Testing DAV connection
********************************************************
OPEN            SUCCEED:                http://192.168.56.101/webdav/
********************************************************
 NOTE            Random string for this session: mV3xQz
 Creating directory
********************************************************
MKCOL           SUCCEED:                Created http://192.168.56.101/webdav/DavTestDir_mV3xQz
********************************************************
 Sending test files
********************************************************
PUT             txt             SUCCEED:        DavTestDir_mV3xQz/davtest_mV3xQz.txt
PUT             php             SUCCEED:        DavTestDir_mV3xQz/davtest_mV3xQz.php
PUT             asp             FAIL
PUT             jsp             FAIL
PUT             pl              SUCCEED:        DavTestDir_mV3xQz/davtest_mV3xQz.pl
********************************************************
 Checking for successful uploads
********************************************************
txt             SUCCEED:        http://192.168.56.101/webdav/DavTestDir_mV3xQz/davtest_mV3xQz.txt
php             SUCCEED:        http://192.168.56.101/webdav/DavTestDir_mV3xQz/davtest_mV3xQz.php
pl              SUCCEED:        http://192.168.56.101/webdav/DavTestDir_mV3xQz/davtest_mV3xQz.pl
********************************************************
 Executable files
********************************************************
http://192.168.56.101/webdav/DavTestDir_mV3xQz/davtest_mV3xQz.php

That last section is the one that matters most — it tells me the server will execute uploaded PHP files, which is a direct path to remote code execution if I can then upload a proper web shell.

Real-World Use Case (Authorized Lab Only)

In a lab setup with an Apache server configured with mod_dav enabled and no extension restrictions, I’ve used the following workflow:

1. Run davtest to confirm which extensions upload and execute.
2. Once I know .php executes, switch to cadaver (see my companion article) to upload a proper web shell.
3. Access the web shell through the browser to demonstrate code execution as part of the report.

This is exactly the kind of finding that goes into a penetration test report as “Unrestricted File Upload via WebDAV leading to RCE” — always with client authorization and inside a scoped engagement.

Workflow Integration

DavTest fits naturally into a broader WebDAV assessment chain:

• Nmap or whatweb to first identify that WebDAV is enabled (OPTIONS method disclosure, DAV header).
• DavTest to enumerate which file types can be uploaded and executed.
• cadaver to manually interact with the share and upload a working payload.
• Burp Suite to intercept and modify the raw PUT requests if DavTest’s automated payloads get blocked by a WAF.

Troubleshooting & Common Mistakes

• “OPEN FAIL” at the start — usually means the URL doesn’t actually have WebDAV enabled, or auth is required and you didn’t pass -auth.
• All uploads fail — check whether the server requires a trailing slash on the URL, or whether it’s behind a WAF blocking PUT requests entirely.
• False negatives on execution — some servers execute files only in specific subdirectories; if DavTest’s random test directory isn’t in an executable path, you’ll get a false “not executable” result. Try uploading directly to the webroot with -uploadloc.
• Forgetting -cleanup — leaving test files behind on a client’s server is bad practice; always clean up or manually verify deletion afterward.

Best Practices

• Always confirm scope and written authorization before testing any WebDAV endpoint.
• Run with -cleanup by default unless you have a reason not to.
• Cross-check DavTest’s executable findings manually — automated tools can produce false positives depending on server caching.
• Document the exact extensions that succeeded, not just a summary, since that detail matters for remediation guidance (e.g., “disable execution of .php in the DAV directory via php_admin_flag engine off“).

FAQ

Does DavTest work against IIS WebDAV as well as Apache? Yes, it’s protocol-based, not server-specific, so it works against any server exposing standard WebDAV methods, including IIS.

Can DavTest bypass extension-based filtering? The -move flag tries uploading as a disallowed extension then renaming via MOVE/COPY to a dangerous extension — a classic bypass technique for filters that only inspect the PUT request’s filename.

Is DavTest safe to run in production? Only with explicit authorization. It writes files to the target server, so treat it like any other active exploitation tool.

Summary

DavTest is a focused, no-nonsense tool for one specific but high-impact question: can I upload and execute arbitrary files on this WebDAV server? Its simplicity is its strength — a two-minute scan gives you a clear yes/no answer on one of the more dangerous WebDAV misconfigurations, and it slots cleanly into a larger toolchain with cadaver and Burp Suite for full exploitation and reporting.

References

• Kali Linux Tools: https://www.kali.org/tools/davtest/
• DavTest source and documentation: https://github.com/cldrn/davtest (mirrors of the original codebase)
• HTTP::DAV Perl module documentation: https://metacpan.org/pod/HTTP::DAV