Which information is primarily enumerated by the http-methods NSE script in Nmap?

• A. Directory listing
• B. HTTP response codes
• C. Available HTTP methods on the server
• D. Server's TLS configuration

Answer: (C)

Knowing which HTTP methods a server allows is what the http-methods NSE script reveals. It sends an OPTIONS probe to the target and reads the server’s response, typically the Allow header, to list the methods the server accepts (such as GET, POST, PUT, DELETE, PATCH, OPTIONS, TRACE, etc.). This helps you spot potential misconfigurations or security risks, like if methods that enable remote data modification (PUT/DELETE) or debugging/echo methods (TRACE) are enabled. While you may see various HTTP status codes in the responses, the script’s main purpose is to enumerate the supported methods rather than cataloging all response codes or TLS-related settings.