HTTP method anomaly (method)

HTTP method anomaly

Unusual or unexpected HTTP methods observed for the target endpoints.

Attack family · Verb abuse and method probing Phase · Reconnaissance and workflow manipulation Risk · Medium

What This Annotator Watches

This explanation is derived from the live annotator implementation, not hand-waved catalog copy.

Focus

Unexpected HTTP verbs for the target surface
Method switching that looks unlike normal browsing
Administrative or probing verbs used against ordinary pages

Logic

The annotator compares the observed verb against expected web usage patterns.
It is useful around 405, 403, and admin-like endpoints.
Strength comes from pairing method oddity with path, status, and velocity.

Attack Family

Verb abuse and method probing

Phase · Reconnaissance and workflow manipulation Risk · Medium

Unexpected methods expose assumptions in routers, middleware, caches, and application handlers. An attacker can learn a surprising amount just by using the wrong verb in the right place.

Damage Patterns

Method abuse can reveal hidden handlers, bypass weak route logic, or trigger unusual state transitions.
It is also a common low-cost way to fingerprint frameworks and administrative surfaces.

Incident Lore

A lot of awkward security bugs looked harmless until someone discovered that one verb was routed or authorized differently from another.
Method oddity is often one of the first signs that the client is testing behavior, not consuming content.

How To Read It

Interpret this as a request-intent clue: the client is using a verb the page probably did not expect.

Defender Takeaway

Interpret this as workflow pressure. Someone is asking the application to behave outside its happy path.

Catalog Definition

Flags requests using HTTP methods that are atypical for the application or for specific endpoints (e.g., unexpected verbs, method switching across retries, or methods inconsistent with normal browsing). This can reflect probing, misuse attempts, or misconfigured clients. Interpret with endpoint intent (browser page vs API vs upload) and response patterns (405/403/400).

HTTP method anomaly

What This Annotator Watches

10 Most Recent Real Samples

Confirm Action