ws-discovery-pentesting

name

ws-discovery-pentesting

description

Pentest WS-Discovery (Web Services Dynamic Discovery) services on UDP port 3702. Use this skill whenever you need to discover network services via multicast, probe for devices like IP cameras, printers, or other WS-Discovery enabled endpoints, or analyze WS-Discovery traffic. Trigger this skill for any network reconnaissance involving port 3702/UDP, service discovery attacks, or when investigating devices that use SOAP-based discovery protocols.

WS-Discovery Pentesting (Port 3702/UDP)

A skill for discovering and pentesting WS-Discovery (Web Services Dynamic Discovery) services on local networks.

Overview

WS-Discovery is a protocol for discovering services within a local network through multicast. It uses SOAP queries over UDP to the multicast address 239.255.255.250:3702.

Key Concepts

• Target Services: Endpoints available for discovery (e.g., IP cameras, printers)
• Clients: Devices actively searching for services
• Multicast Address: 239.255.255.250:3702
• Protocol: SOAP over UDP

WS-Discovery Message Types

Message	Direction	Purpose
Hello	Multicast	Service announces presence on network
Probe	Multicast	Client searches for services by Type
Probe Match	Unicast	Service responds to matching Probe
Resolve	Multicast	Client identifies service by name
Resolve Match	Unicast	Service confirms identity
Bye	Multicast	Service signals departure

Scanning for WS-Discovery Services

Using wsdd-discover

# Basic scan for all WS-Discovery services
wsdd-discover

# Scan with specific timeout
wsdd-discover -t 5

# Scan with verbose output
wsdd-discover -v

Using nmap

# Nmap script for WS-Discovery
nmap -sU -p 3702 --script wsdd-discover <target>

# Example output:
# PORT     STATE         SERVICE
# 3702/udp open|filtered unknown
# | wsdd-discover:
# |   Devices
# |     Message id: 39a2b7f2-fdbd-690c-c7c9-deadbeefceb3
# |     Address: http://10.0.200.116:50000
# |_    Type: Device wprt:PrintDeviceType

Using Python Script

Run the bundled script for automated probing:

python scripts/ws-discovery-probe.py --target 239.255.255.250 --port 3702

Probing for Specific Device Types

WS-Discovery uses Type identifiers to categorize devices. Common types include:

Common Device Types

Type	Description	Example
wsc:Service	Generic WS-Discovery service	Base type
wsc:Device	Generic device	Base device type
wprt:PrintDeviceType	Printer devices	Network printers
NetworkVideoTransmitter	IP cameras	Surveillance cameras
upnp:rootdevice	UPnP root device	UPnP-enabled devices
wsc:WiFiDevice	WiFi devices	Wireless access points

Probe for Specific Type

# Probe for IP cameras
python scripts/ws-discovery-probe.py --type NetworkVideoTransmitter

# Probe for printers
python scripts/ws-discovery-probe.py --type wprt:PrintDeviceType

# Probe for all devices
python scripts/ws-discovery-probe.py --type wsc:Device

Analyzing WS-Discovery Responses

Response Structure

<e:Envelope xmlns:e="http://www.w3.org/2003/05/soap-envelope">
  <e:Header>
    <a:Action xmlns:a="http://www.w3.org/2005/08/addressing">
      http://schemas.xmlsoap.org/ws/2005/04/discovery/ProbeMatches
    </a:Action>
  </e:Header>
  <e:Body>
    <d:ProbeMatches xmlns:d="http://schemas.xmlsoap.org/ws/2005/04/discovery">
      <d:ProbeMatch>
        <d:Types>NetworkVideoTransmitter</d:Types>
        <d:Scp>...</d:Scp>
        <a:Address xmlns:a="http://www.w3.org/2005/08/addressing">
          http://10.0.200.116:50000
        </a:Address>
        <d:XAddrs>...</d:XAddrs>
      </d:ProbeMatch>
    </d:ProbeMatches>
  </e:Body>
</e:Envelope>

Key Fields to Extract

1. Address: HTTP endpoint for the service
2. Types: Device/service type identifier
3. Scp: Service Control Point capabilities
4. XAddrs: Extended addresses
5. Message ID: Unique identifier for the response

Attack Vectors

1. Service Enumeration

Discover all WS-Discovery services on the network:

# Enumerate all services
python scripts/ws-discovery-probe.py --enumerate

# Save results to file
python scripts/ws-discovery-probe.py --output ws-discovery-results.json

2. Targeted Probing

Probe for specific device types that may have vulnerabilities:

# Target IP cameras (often have weak authentication)
python scripts/ws-discovery-probe.py --type NetworkVideoTransmitter

# Target printers (may expose management interfaces)
python scripts/ws-discovery-probe.py --type wprt:PrintDeviceType

3. Spoofing Attacks

Send crafted WS-Discovery messages to:

• Trigger responses from hidden services
• Test service behavior with malformed messages
• Enumerate service capabilities

4. Information Disclosure

Extract sensitive information from responses:

• Device names and models
• Network topology
• Service endpoints
• Configuration details

Security Considerations

Risks

1. Information Disclosure: WS-Discovery reveals device types, addresses, and capabilities
2. Network Mapping: Attackers can map the entire network topology
3. Target Identification: Specific device types may indicate vulnerable services
4. Service Manipulation: Malformed messages may crash or exploit services

Mitigations

1. Disable WS-Discovery on devices that don't need it
2. Network Segmentation: Isolate WS-Discovery traffic to specific VLANs
3. Firewall Rules: Block multicast traffic at network boundaries
4. Monitor Traffic: Detect unusual WS-Discovery activity

Testing Checklist

• Scan for WS-Discovery services on target network
• Enumerate all discovered devices and their types
• Probe for specific device types (cameras, printers, etc.)
• Extract service endpoints and addresses
• Test for information disclosure in responses
• Document all findings and potential attack vectors
• Verify no sensitive information is exposed

References

• WS-Discovery Protocol Specification
• HackTricks WS-Discovery
• Nmap wsdd-discover Script