Web Service Attack Part 1 Simple Object Access Protocol (SOAP) (1)

Bkjia.com exclusive translation] In general, Web services have always been a niche tool that is difficult to accurately define, interpret, and use. This is actually a misunderstanding. Click here for details. I also want to eliminate this misunderstanding through some technical and code examples. In this article, we will specifically discuss SOAP. Of course, JSON and REST are also popular important standards, but here we will focus on SOAP.

Simple Object Access Protocol or SOAP is a set of mechanisms that use XML architecture for information interaction and are mainly implemented through HTTP protocol. Web service protocol is a relatively lightweight communication mechanism that has outstanding functions in API connection drivers and is common in mobile device applications.

You must install Jruby, Buby, Savon, Nokogiri gems, and download or purchase the Burp suite produced by PortSwigger in advance. The basic idea of the entire discussion process is to make the process of attacking SOAP easier to grasp by in-depth mining and expanding some Burp functions to a certain extent.

As mentioned above, SOAP information communication is based on the XML architecture. This XML architecture can be defined as a WSDL or "Web Service Description Language" file. This Information Description provides valuable space for data attack formulation and request formation.

SOAP execution and its parameters are valuable information units that can be extracted from the WSDL. Operations such as obtaining email addresses can be implemented through parameters and assignments such as "profileid = 1000. Create this request, change the value assignment of profileid, and send it to the target location, so that we can get the email address of other users.

Now we can manually list the WSDL by checking the response inside the XML tag and obtaining the big value of the data, but how can we quickly and seamlessly achieve the above goal without creating repeated code?

Install JRuby

$ sudo apt-get install jruby

Install Savon and Buby gems

$ sudo jruby -S gem install buby
$ sudo jruby -S gem install savon

Now we need to write some code. Savon gem is a Ruby/JRuby function library that allows us to create a SOAP client and interact with Web Services. Create a file named attack_soap.rb and click here to get the code.) then, enter the following code: