A transit admin delete action is blocked on POST but succeeds when the same URL is requested with PUT or DELETE. What attack class does this illustrate?
Select an answer to reveal the explanation.
Short Explanation
Guards who only check the front door miss the side entrance. If authz is wired only to POST, other verbs can sneak the same action through. That is HTTP verb tampering — same resource, different method, different outcome.
Full Explanation
HTTP method (verb) tampering exploits authorization or routing logic that only validates common methods such as GET and POST. Alternate verbs like PUT, DELETE, or PATCH may reach handlers without the same checks. Testers should compare method behavior on sensitive endpoints and recommend consistent server-side enforcement for every verb. Network-layer ideas such as DNS or ARP poisoning do not explain this application behavior.