performing-soap-web-service-security-testing

name	performing-soap-web-service-security-testing
description	Perform security testing of SOAP web services by analyzing WSDL definitions and testing for XML injection, XXE, WS-Security bypass, and SOAPAction spoofing.
domain	cybersecurity
subdomain	api-security
tags	["soap","web-services","wsdl","xml-injection","xxe","ws-security","penetration-testing","soapaction-spoofing","xpath-injection"]
version	1.0
author	mahipal
license	Apache-2.0

Performing SOAP Web Service Security Testing

Overview

SOAP (Simple Object Access Protocol) web services remain widely deployed in enterprise environments, financial systems, healthcare, and government integrations. Security testing of SOAP services involves analyzing WSDL (Web Services Description Language) definitions to understand available methods, testing for XML-based injection attacks (XXE, XPath injection, XML bombs), evaluating WS-Security implementation correctness, SOAPAction header spoofing, and assessing authentication and authorization controls. Unlike REST APIs, SOAP services use XML envelopes and often implement complex security standards that can be misconfigured.

Prerequisites

• Target SOAP web service endpoint URL
• WSDL file or URL access for the service
• SoapUI or ReadyAPI for structured testing
• Burp Suite with SOAP extensions for interception
• Python 3.8+ with zeep and lxml libraries
• Authorization to perform security testing

Testing Methodology

Phase 1: WSDL Reconnaissance

#!/usr/bin/env python3
"""SOAP Web Service Security Testing Tool

Analyzes WSDL definitions and tests SOAP endpoints for
common vulnerabilities including XXE, injection, and
WS-Security misconfigurations.
"""

import requests
import xml.etree.ElementTree as ET
from lxml import etree
import sys
import re
from typing import List, Dict, Optional
from dataclasses import dataclass

@dataclass
class SOAPOperation:
    name: str
    action: str
    input_message: str
    output_message: str
    parameters: List[Dict]

class SOAPSecurityTester:
    NAMESPACES = {
        'wsdl': 'http://schemas.xmlsoap.org/wsdl/',
        'soap': 'http://schemas.xmlsoap.org/wsdl/soap/',
        'soap12': 'http://schemas.xmlsoap.org/wsdl/soap12/',
        'xsd': 'http://www.w3.org/2001/XMLSchema',
        'wsse': 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd',
    }

    def __init__(self, wsdl_url: str, endpoint_url: Optional[str] = None):
        self.wsdl_url = wsdl_url
        .endpoint_url = endpoint_url
        .operations: [SOAPOperation] = []
        .findings: [] = []

     () -> [SOAPOperation]:
        
        response = requests.get(.wsdl_url, timeout=)
        root = etree.fromstring(response.content)

        
          .endpoint_url:
            address = root.find(, .NAMESPACES)
             address   :
                .endpoint_url = address.get()

        
         binding_op  root.findall(, .NAMESPACES):
            name = binding_op.get()
            soap_op = binding_op.find(, .NAMESPACES)
            action = soap_op.get(, )  soap_op     

            operation = SOAPOperation(
                name=name,
                action=action,
                input_message=,
                output_message=,
                parameters=[]
            )
            .operations.append(operation)

        ()
         op  .operations:
            ()

         .operations

     () -> :
        
        xxe_payloads = [
            
            {
                : ,
                : .(operation=operation.name)
            },
            
            {
                : ,
                : .(operation=operation.name)
            },
            
            {
                : ,
                : .(operation=operation.name)
            }
        ]

        results = []
         xxe  xxe_payloads:
            :
                response = requests.post(
                    .endpoint_url,
                    data=xxe[],
                    headers={
                        : ,
                        : operation.action,
                    },
                    timeout=
                )

                vulnerable = 
                indicators = []

                   response.text    response.text:
                    vulnerable = 
                    indicators.append()

                 response.status_code ==      response.text:
                    indicators.append()

                 response.elapsed.total_seconds() > :
                    indicators.append()
                    vulnerable = 

                result = {
                    : xxe[],
                    : vulnerable,
                    : response.status_code,
                    : response.elapsed.total_seconds(),
                    : indicators
                }
                results.append(result)

                 vulnerable:
                    .findings.append({
                        : ,
                        : ,
                        : operation.name,
                        : xxe[]
                    })

             requests.exceptions.Timeout:
                results.append({
                    : xxe[],
                    : ,
                    : []
                })

         {: operation.name, : results}

     () -> :
        
        sqli_payloads = [
            ,
            ,
            ,
            ,
            ,
        ]

        results = []
         payload  sqli_payloads:
            soap_body = 

            :
                response = requests.post(
                    .endpoint_url,
                    data=soap_body,
                    headers={
                        : ,
                        : operation.action,
                    },
                    timeout=
                )

                sql_errors = [
                    , , , ,
                    , ,
                    , 
                ]
                error_found = (err  response.text  err  sql_errors)

                 error_found:
                    .findings.append({
                        : ,
                        : ,
                        : operation.name,
                        : 
                    })

                results.append({
                    : payload,
                    : response.status_code,
                    : error_found,
                    : response.elapsed.total_seconds()
                })

             requests.exceptions.RequestException:
                

         {: operation.name, : results}

     () -> :
        
        results = []

         i, operation  (.operations):
             j, other_op  (.operations):
                 i == j:
                    

                
                soap_body = 

                :
                    response = requests.post(
                        .endpoint_url,
                        data=soap_body,
                        headers={
                            : ,
                            : other_op.action,  
                        },
                        timeout=
                    )

                     response.status_code ==      response.text:
                        .findings.append({
                            : ,
                            : ,
                            : operation.name,
                            : 
                        })
                        results.append({
                            : operation.name,
                            : other_op.action,
                            : 
                        })

                 requests.exceptions.RequestException:
                    

         {: results}

     () -> :
        
        test_cases = [
            {
                : ,
                : 
            },
            {
                : ,
                : 
            },
            {
                : ,
                : 
            }
        ]

        results = []
         test  test_cases:
             .operations:
                operation = .operations[]
                soap_body = 

                :
                    response = requests.post(
                        .endpoint_url,
                        data=soap_body,
                        headers={: },
                        timeout=
                    )

                    accepted = response.status_code ==      response.text
                     accepted:
                        .findings.append({
                            : ,
                            : ,
                            : operation.name,
                            : test[]
                        })

                    results.append({
                        : test[],
                        : accepted,
                        : response.status_code
                    })
                 requests.exceptions.RequestException:
                    

         {: results}

     () -> :
        
         {
            : .endpoint_url,
            : .wsdl_url,
            : (.operations),
            : (.findings),
            : ([f  f  .findings  f[] == ]),
            : ([f  f  .findings  f[] == ]),
            : .findings
        }


 ():
    wsdl_url = sys.argv[]  (sys.argv) >   
    tester = SOAPSecurityTester(wsdl_url)

    ()
    operations = tester.parse_wsdl()

     op  operations:
        ()
        tester.test_xxe_vulnerability(op)
        tester.test_sql_injection(op)

    tester.test_soapaction_spoofing()
    tester.test_ws_security_bypass()

    report = tester.generate_report()
    ()
    ()
    ()
    ()
    ()
    (
          )

     finding  report[]:
        ()
        ()
        ()


 __name__ == :
    main()

References

• SecureLayer7 OWASP SOAP Pentesting: https://blog.securelayer7.net/owasp-top-10-pentesting-mitigating-soap-service-risks/
• BrightSec SOAP Vulnerabilities: https://brightsec.com/blog/top-7-soap-api-vulnerabilities/
• Levo.ai SOAP API Security Testing Guide: https://www.levo.ai/resources/blogs/soap-api-security-testing
• SoapUI Web Service Hacking: https://www.soapui.org/docs/soap-and-wsdl/tips-and-tricks/web-service-hacking/
• PortSwigger XXE Tutorial: https://portswigger.net/web-security/xxe