Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

There's more...

By setting the script argument http-methods.retest, we can test each HTTP method listed by OPTIONS and analyze the return value to conclude if TRACE is accessible and not blocked by a firewall or configuration rules.

$ nmap -p80 --script http-methods,http-trace --script-args http-methods.retest <target>    PORT    STATE SERVICE    80/tcp  open  http    |_http-trace: TRACE is enabled    | http-methods: GET HEAD POST OPTIONS TRACE    | Potentially risky methods: TRACE    | See http://nmap.org/nsedoc/scripts/http-methods.html    | GET / -> HTTP/1.1 200 OK    |    | HEAD / -> HTTP/1.1 200 OK    |    | POST / -> HTTP/1.1 200 OK    |    | OPTIONS / -> HTTP/1.1 200 OK    |    |_TRACE / -> HTTP/1.1 200 OK 

Remember that the method TRACE could be enabled and not listed ...