Testing: WS Information Gathering (OWASP-WS-001) - Revision history

Aditya Balapure at 09:20, 4 July 2013

2013-07-04T09:20:04Z

2013-07-04T09:15:25Z

2013-07-04T07:43:04Z

2011-05-31T04:05:16Z

‎Black Box Testing and example

2011-05-31T04:02:35Z

‎Black Box Testing and example

2011-05-31T03:59:18Z

‎Black Box Testing and example

2009-02-10T01:26:41Z

‎References

2009-02-10T01:23:47Z

‎Black Box Testing and example

2009-02-10T01:22:25Z

‎Black Box Testing and example

2009-02-10T01:18:27Z

‎Brief Summary

@@ Line 120: / Line 120: @@
 <br>
 ''' UDDI Browser''' <br>
-A web server that provides a very useful UDDI on-line tool to browse and search public UDDI resources is offered on http://www.soapclient.com.<br>
+A web server that provides a very useful UDDI on-line tool to browse and search public UDDI resources is offered on http://www.soapclient.com/uddisearch.html.<br>
 We can see we can use two operators, Microsoft and XMethods

@@ Line 120: / Line 120: @@
 <br>
 ''' UDDI Browser''' <br>
-A web server that provides a very useful UDDI on-line tool for to browse and search public UDDI resource in offered from http://www.soapclient.com.<br>
+A web server that provides a very useful UDDI on-line tool to browse and search public UDDI resources is offered on http://www.soapclient.com.<br>
 We can see we can use two operators, Microsoft and XMethods

@@ Line 56: / Line 56: @@
 </wsdl:definitions>
 </pre>
-This WS simply receives in input a logical name (EnterURL) and gives in output the realtive IP Address. So we have GetURLIP as method for the WS and EnterURL (string) as input.
+This WS simply receives in input a logical name (EnterURL) and gives in output the relative IP Address. So we have GetURLIP as method for the WS and EnterURL (string) as input.
 In that manner we have identified the WS entry point and we are ready to test it.
 <br>

@@ Line 143: / Line 143: @@
 '''Command line interaction'''
 <br>
-Sometimes it is useful to interact with webservives from a command line.
+Sometimes it is useful to interact with webservices from a command line.
 <br>
 <br>

@@ Line 17: / Line 17: @@
 '''WSDL endpoints'''<br>
 When a tester accesses the WSDL, he can determine an access point and available interfaces for web services. These interfaces or methods take inputs using SOAP over HTTP/HTTPS. If these inputs are not defined well at the source code level, they can be compromised and exploited.
-For example given this WDSL Endpoint:
+For example given this WSDL Endpoint:
   http://www.example.com/ws/FindIP.asmx?WSDL

@@ Line 13: / Line 13: @@
 and you will find all the public Example WSDL.
-Net Square wsPawn is a useful tool that acts as Web Services Consumer and makes a query to the UBR and looks for services as per requirements. Then UBR supplies the list of available services. The Web Services Consumer chooses one or more available services. Next, Web Services Consumer requests an access point or end point for these services. UBR supplies this information. From this moment, Web Services Consumer approaches the Web Services Supplier’s Host/IP address (WDSL) and starts accessing service.<br>
+Net Square wsPawn is a useful tool that acts as Web Services Consumer and makes a query to the UBR and looks for services as per requirements. Then UBR supplies the list of available services. The Web Services Consumer chooses one or more available services. Next, Web Services Consumer requests an access point or end point for these services. UBR supplies this information. From this moment, Web Services Consumer approaches the Web Services Supplier’s Host/IP address (WSDL) and starts accessing service.<br>
 '''WSDL endpoints'''<br>

@@ Line 213: / Line 213: @@
 * Web Services Directory: http://www.wsindex.org
 * Seekda: http://seekda.com/
-* UDDI Browser: http://www.soapcliet.com/
+* UDDI Browser: http://www.soapclient.com/
 * Xmethods: http://www.xmethods.net
 * WSIndex: http://www.wsindex.org

@@ Line 63: / Line 63: @@
 Web Services consumer needs a simple and standardized way to find Web Services available from remote servers.
 There are two ways to discover a Web Service, DISCO and UDDI.<br>
-The Web Service Discovery (DISCO) is one way that we can use to discover the URLs WSDL descriptor and other XML documents, like Schema Definition Document (.xsd).<br>
+The Web Service Discovery (DISCO) is one way that we can discover the URL's WSDL descriptor and other XML documents, like Schema Definition Document (.xsd).<br>
 For instance, with an HTTP query to a Web server:
@@ Line 78: / Line 78: @@
 </pre>
 <br>
-how we can see in the above XML document we have a reference for WSDL document where obtain a descriptions of Web Services available from remote Web Server.
+We can see in the above XML document we have a reference for a WSDL document, where we can obtain a description of Web Services available from remote Web Server.
 DISCO is a Microsoft technology, UDDI (Universal Description, Discovery and Integration) is an OASIS standard .
@@ Line 85: / Line 85: @@
 Common Web Services  platforms have a naming convention for offering a WSDL documents: This naming convention can be used to retrieve WSDL via URIs probing or through queries to web search server.
-Some URLs that we can use are for example:
+Some URLs that we can use are, for example:
   http://<webservice-host>:<port>/<servicename>

@@ Line 2: / Line 2: @@
 ==Brief Summary==
-The first step to perform a Web Service Test is to determine the WS entry points and the communication schema: this is described in the WSDL associated with the WS.
+The first step to perform a Web Service Test is to determine the WS entry points and the communication schema: this is described in the WSDL associated with the Web Service.
 ==Black Box Testing and example==