Cross site tracing is a type of web application vulnerability which results in cross site scripting with http TRACE method. TRACE is a http requesting method which simply echoes back whatever the user send to the server. If a website respond to TRACE request then we can confirm that it is vulnerable to cross site tracing shortly called XST. It's very easy to test cross site tracing, you can test it with burp suite repeater, OWASP ZAP request tab or you can use curl command in command prompt. This vulnerability is easy to find out and probably for the beginners to try out for to get start into ethical hacking
Testing method:- Just open your command prompt (cmd) or MS DOS. Remember curl need to be downloaded and installed manually for using curl command ( for beginners). Just type the command curl -X TRACE url . For example curl -X TRACE google.com for testing whether Google accept HTTP TRACE method. In penetration testing software's like burp suite, ZAP you just need to send a request like TRACE url. Example TRACE google.com.In the below image you can see the request that I made and response that I got.
Test result:- If the web application doesn't accept HTTP TRACE method then you will get an http status code 405 or 301 in the response or output. If the response gives a http status code 200 then it is vulnerable to cross site tracing ( xst ) and with that possibility cross site scripting ( xss ) is possible.