Category:OWASP WSFuzzer Project - Revision history

Aandreu: /* Configuration File Examples */

2010-09-13T03:55:25Z

‎Configuration File Examples

Aandreu: /* Command line usage */

2010-09-13T03:51:47Z

‎Command line usage

Aandreu: /* Install */

2010-09-13T03:38:31Z

‎Install

Aandreu: /* Features */

2010-09-13T03:37:32Z

‎Features

Aandreu: /* Current Version */

2010-09-13T03:34:44Z

‎Current Version

Paulo Coimbra at 17:54, 9 March 2010

2010-03-09T17:54:36Z

Paulo Coimbra at 17:52, 9 March 2010

2010-03-09T17:52:20Z

Mtesauro: Added category tags

2009-09-25T14:16:29Z

Added category tags

Wichers: /* Run-Time Examples */

2009-04-10T17:52:41Z

‎Run-Time Examples

Wichers: /* Features */

2009-04-10T17:45:23Z

‎Features

@@ Line 172: / Line 172: @@
      bauser - basic auth username
      bapass - basic auth password
      keyfile - full path to the key file
      certfile - full path to the cert file
@@ Line 185: / Line 187: @@
      bauser
      bapass
      keyfile
      certfile
@@ Line 205: / Line 209: @@
      bauser
      bapass
      keyfile
      certfile
@@ Line 223: / Line 229: @@
      bauser
      bapass
      keyfile
      certfile

@@ Line 110: / Line 110: @@
 == Command line usage ==
-'''Usage: python WSFuzzer.py [-w wsdl_url | -e endpoint -n namespace |  --xml | -h host | --conf  | --bauser username --bapass password |  --keyfile keyfile --certfile certfile |  --proxy proxyserver --proxyport port | --attacks]'''<br>
+   Usage: python WSFuzzer.py  [
--w WSDL_URL -- A FQDN WSDL URL - i.e. http://host/service/service.asmx?wsdl<br>
+    -w WSDL_URL --- A FQDN WSDL URL - i.e. http://host/service/service.asmx?wsdl<br>
-Example: python WSFuzzer.py -w http://host/service/service.asmx?wsdl<br>
+    -e endpoint -n namespace --- -e and -n are used together
+        -e is the web service endpoint --- i.e. WSDL URL
--e endpoint -n namespace -- -e and -n are used together<br>
+        -n is the web service namespace --- i.e. URI
--e is the web service endpoint -- i.e. WSDL URL<br>
+        ** When using -e and -n you will have to manually establish the method to be attacked<br>
--n is the web service namespace -- i.e. URI<br>
+    --xml --- A text file of the XML payload to be used against the target<br>
-When using -e and -n you will have to manually establish the method to be attacked<br>
+    -h host --- A URL of the target host.  This option will do some digging into
-Example: python WSFuzzer.py -e "http://host/service/service.asmx" -n "urn:querySOAP"<br>
+                the target URL, it will scrape for anything WSDL or DISCO related and construct"
-<br>
+                a list of verified WSDL URL's<br>
---xml --- A text file of the XML payload to be used against the target<br><br>
+    --conf file --- A file containing some config data so as to automate some of the"
--h host -- A URL of the target host. This option will do some digging into the target URL, it will scrape for anything WSDL or DISCO related and construct a list of verified WSDL URL's<br>
+                    normally interactive parts of WSFuzzer<br>
-Example: python WSFuzzer.py -h http://host<br>
+    --bauser username --bapass password --- these 2 optional arguments are used together whenever HTTP Basic Auth needs to be used
-<br>
+        --bauser is a Basic Auth username
---conf --- A file containing some config data so as to automate some of the normally interactive parts of WSFuzzer<br>
+        --bapass is a Basic Auth password to be used with the "bauser" username<br>
-<br>
+    --xsseuser username --xssepass password --- these 2 optional arguments are used together whenever WS-Security Auth needs to be used
---bauser username --bapass password --- these 2 optional arguments are used together whenever HTTP Basic Auth needs to be used<br>
+        --xsseuser is a WS-Security username
---bauser is a Basic Auth username<br>
+        --xssepass is a WS-Security password to be used with the "xsseuser" username<br>
---bapass is a Basic Auth password to be used with the "bauser" username<br>
+    --keyfile keyfile --certfile certfile --- these 2 optional arguments are used together whenever client-side certs need to be used
-<br>
+        --keyfile is the PEM formatted file that contains the respective private key to be used
---keyfile keyfile --certfile certfile --- these 2 optional arguments are used together whenever client-side certs need to be used<br>
+        --certfile is the PEM formatted file that contains the X.509 certificate to be used with the "keyfile"<br>
---keyfile is the PEM formatted file that contains the respective private key to be used<br>
+    --proxy server_info --proxyport port --- these 2 optional arguments are used together
---certfile is the PEM formatted file that contains the X.509 certificate to be used with the "keyfile"<br>
+        --proxy is a Proxy server's IP address or FQDN
-<br>
+        --proxyport is the number of the TCP port for the server identified in switch --proxy<br>
---attacks is the name of a XML attack vector file previously generated by WSFuzzer<br>
+    --attacks is the name of a XML attack vector file previously generated by WSFuzzer<br>
 == Configuration File Examples ==

@@ Line 30: / Line 30: @@
 Pre-requisites:
-Python 2.5/2.6<br>
+Python 2.6/2.7<br>
 PyXML<br>
 Java 1.6.X<br>

@@ Line 79: / Line 79: @@
 * WSFuzzer has the ability to Fuzz methods with multiple parameters. There are 2 modes of attack/fuzzing: "individual" and "simultaneous". Each parameter is either handled as a unique entity (individual mode), and can either be attacked or left alone, or multiple parameters are attacked simultaneously (hence the name - simultaneous mode) with a given data set.<br>
 * The fuzz generation (attack strings) consists of a combination of a dictionary file, some optional dynamic large injection patterns, and some optional method specific attacks including automated XXE and WSSE attack generation.<br>
 * The tool also provides the option of using some IDS Evasion techniques which makes for a powerful security infrastructure (IDS/IPS) testing experience.<br>
 * A time measurement of each round trip between request and response is now provided to potentially aid in results analysis.<br>
 * For any given program run, the generated attack vectors are saved out to an XML file. The XML file is named XXX and is located in the same directory where the results HTML file is saved.
 * A previously generated XML file of attack vectors can be utilized instead of the dictionary/automated combo. This is for the sake of repeatability when the same vectors need to be used over and over again.

@@ Line 24: / Line 24: @@
 == Current Version ==
-.9.4
+.9.5
 == Install ==

@@ Line 705: / Line 705: @@
 http://images.sourceforge.net/images/project-support.jpg [http://sourceforge.net/donate/index.php?group_id=155697 Make a Donation]
-[[Category:OWASP Project]]
+[[Category:OWASP Project|WSFuzzer Project]]
 [[Category:OWASP Download]]
 [[Category:OWASP Tool]]

@@ Line 1: / Line 1: @@
 [[:Category:OWASP Project|Click here to return to OWASP Projects page.]]<br>
 [[:Project Information:template WSFuzzer Project|Click here to see (& edit, if wanted) the template.]]
-{{:Project Information:template WSFuzzer Project}}
+{{:Project Information:template WSFuzzer Project|WSFuzzer Project}}
 == Overview ==

← Older revision		Revision as of 14:16, 25 September 2009
Line 704:		Line 704:

	http://images.sourceforge.net/images/project-support.jpg [http://sourceforge.net/donate/index.php?group_id=155697 Make a Donation]		http://images.sourceforge.net/images/project-support.jpg [http://sourceforge.net/donate/index.php?group_id=155697 Make a Donation]
		+
		+	[[Category:OWASP Project]]
		+	[[Category:OWASP Download]]
		+	[[Category:OWASP Tool]]

@@ Line 263: / Line 263: @@
 Here are examples of different types of runs:
-‡ python WSFuzzer --conf confmode3.txt<br>
+* python WSFuzzer --conf confmode3.txt<br>
-‡ python WSFuzzer -w http://target/service/service.asmx?wsdl<br>
+* python WSFuzzer -w http://target/service/service.asmx?wsdl<br>
-‡ python WSFuzzer -e http://target/service/service.asmx -n urn:service<br>
+* python WSFuzzer -e http://target/service/service.asmx -n urn:service<br>
-‡ python WSFuzzer --xml file.xml<br>
+* python WSFuzzer --xml file.xml<br>
-‡ python WSFuzzer -h http://target<br>
+* python WSFuzzer -h http://target<br>
 Upon completion of a run the current output is based on a directory the prog will create. That dir is created within the root dir where the program is installed and run from. By default the pattern for dir creation is based on the string FuzzingResults-N. N is dynamically calculated based on existing directories fitting the pattern. So if you run the prog from "/opt/WSFuzzer" for instance you will end up with something like:
-‡ /opt/WSFuzzer/FuzzingResults-0<br>
+* /opt/WSFuzzer/FuzzingResults-0<br>
-‡ /opt/WSFuzzer/FuzzingResults-1<br>
+* /opt/WSFuzzer/FuzzingResults-1<br>
-‡ ...<br>
+* ...<br>
-‡ /opt/WSFuzzer/FuzzingResults-N<br>
+* /opt/WSFuzzer/FuzzingResults-N<br>
 In each one of these directories there will be an index.html file and a dir called HeaderData.
 index.html will give you an overview of the results as such:
      Method 	Request Params 	        IDS evasion 	                Response 	Http Info 	Round Trip
      xpath 	{'parameters': '%00'} 	/WSDIGGeR_WS/WSDiggER_WS.AsMX 	Soap Fault 	HTTP Log 	276.2158 M
      xpath 	{'parameters': 'TRUE'} 	/WSDIggER_WS/WSDIgGer_WS.AsMx 	Soap Fault 	HTTP Log 	2.88 S
 In the HeaderData dir you will find files that hold a Request / Response pair for each of the attacks sent to the target. One file has one Request and one Response. In some cases there will be no response if the attack Request caused some sort of crash on the server (500 status response, etc). Each one of the links in the Http Info column will provide you a path into the respective file as per the rest of the data in that row.
@@ Line 346: / Line 343: @@
 ** This option (--xml) is ideal for the use of WSFuzzer when targeting .Net services/hosts. In order to use this option successfully you need to know/have the following in reference to your target:
-‡ A valid XML payload. All you need to do is use whatever method you'd like to generate a valid payload based on your target. As a pen tester this is usually no problem since you are working closely with the target's developers/engineers.<br>
+* A valid XML payload. All you need to do is use whatever method you'd like to generate a valid payload based on your target. As a pen tester this is usually no problem since you are working closely with the target's developers/engineers.<br>
-‡ Proper host data in the form of host.domain or an IP address, i.e. sec.neurofuzz.com or 192.168.1.207<br>
+* Proper host data in the form of host.domain or an IP address, i.e. sec.neurofuzz.com or 192.168.1.207<br>
-‡ Proper resource data (URI), i.e. /WSDigger_WS/WSDigger_WS.asmx<br>
+* Proper resource data (URI), i.e. /WSDigger_WS/WSDigger_WS.asmx<br>
-‡ If you are targeting a .Net service you will also need to know the value for a valid SOAPAction HTTP header, this could be the name of the method or a FQDN - it totally depends on how the target services were built. For instance in the example above the SOAPAction value is: http://foundstone.com/Stringproc/xpath<br>
+* If you are targeting a .Net service you will also need to know the value for a valid SOAPAction HTTP header, this could be the name of the method or a FQDN - it totally depends on how the target services were built. For instance in the example above the SOAPAction value is: http://foundstone.com/Stringproc/xpath<br>
 === Individual Mode / No IDS Evasion ===
@@ Line 434: / Line 431: @@
      authenticateUser 	{'in0': '\\00', 'in1': None, 'in2': None}  None 	0 	   HTTP Log 	2.88 S
 === Simultaneous Mode / No IDS Evasion ===
 Here is a snippet from a run utilizing simultaneous mode and no IDS Evasion:
@@ Line 504: / Line 500: @@
      authenticateUser 	{'in0': '/*', 'in1': '/*', 'in2': '/*'} 	None 	        0 	        HTTP Log 	2.88 S
      authenticateUser 	{'in0': '\\00', 'in1': '\\00', 'in2': '\\00'} 	None 	        0 	        HTTP Log 	276.2158 M
 === Discovery / IDS Evasion ===

@@ Line 74: / Line 74: @@
 == Features ==
-‡ Pen tests an HTTP SOAP web service based on either valid WSDL, known good XML payload, or a valid endpoint & namespace.<br>
+* Pen tests an HTTP SOAP web service based on either valid WSDL, known good XML payload, or a valid endpoint & namespace.<br>
-‡ It can try to intelligently detect WSDL for a given target.<br>
+* It can try to intelligently detect WSDL for a given target.<br>
-‡ Includes a simple TCP port scanner.<br>
+* Includes a simple TCP port scanner.<br>
-‡ WSFuzzer has the ability to Fuzz methods with multiple parameters. There are 2 modes of attack/fuzzing: "individual" and "simultaneous". Each parameter is either handled as a unique entity (individual mode), and can either be attacked or left alone, or multiple parameters are attacked simultaneously (hence the name - simultaneous mode) with a given data set.<br>
+* WSFuzzer has the ability to Fuzz methods with multiple parameters. There are 2 modes of attack/fuzzing: "individual" and "simultaneous". Each parameter is either handled as a unique entity (individual mode), and can either be attacked or left alone, or multiple parameters are attacked simultaneously (hence the name - simultaneous mode) with a given data set.<br>
-‡ The fuzz generation (attack strings) consists of a combination of a dictionary file, some optional dynamic large injection patterns, and some optional method specific attacks including automated XXE and WSSE attack generation.<br>
+* The fuzz generation (attack strings) consists of a combination of a dictionary file, some optional dynamic large injection patterns, and some optional method specific attacks including automated XXE and WSSE attack generation.<br>
-‡ The tool also provides the option of using some IDS Evasion techniques which makes for a powerful security infrastructure (IDS/IPS) testing experience.<br>
+* The tool also provides the option of using some IDS Evasion techniques which makes for a powerful security infrastructure (IDS/IPS) testing experience.<br>
-‡ A time measurement of each round trip between request and response is now provided to potentially aid in results analysis.<br>
+* A time measurement of each round trip between request and response is now provided to potentially aid in results analysis.<br>
-‡ For any given program run the generated attack vectors are saved out to an xml file. The XML file is named XXX and is located in the same directory where the results HTML file is saved.
+* For any given program run, the generated attack vectors are saved out to an XML file. The XML file is named XXX and is located in the same directory where the results HTML file is saved.
-‡ A previously generated XML file of attack vectors can be utilized instead of the dictionary/automated combo. This is for the sake of repeatability when the same vectors need to be used over and over again.
+* A previously generated XML file of attack vectors can be utilized instead of the dictionary/automated combo. This is for the sake of repeatability when the same vectors need to be used over and over again.
-One source of the WSFuzzer feature set is our user community. So if you feel a feature would be useful please submit it to us at: [https://sourceforge.net/tracker/?func=add&group_id=155697&atid=796844 sourceforge]
+One source of the WSFuzzer feature set is our user community. So if you feel a feature would be useful, please submit it to us at: [https://sourceforge.net/tracker/?func=add&group_id=155697&atid=796844 sourceforge]
 == Dictionary file structure ==