Testing WSDL (OWASP-WS-002) - Revision history

KirstenS: /* Black Box testing and example */

2009-02-10T01:29:49Z

‎Black Box testing and example

KirstenS: /* Black Box testing and example */

2009-02-10T01:27:56Z

‎Black Box testing and example

KirstenS: /* Black Box testing and example */

2009-02-10T01:27:43Z

‎Black Box testing and example

KirstenS: Testing WSDL moved to Testing WSDL (OWASP-WS-002)

2008-12-15T23:41:37Z

Testing WSDL moved to Testing WSDL (OWASP-WS-002)

KirstenS: /* Black Box testing and example */

2008-12-14T02:40:35Z

‎Black Box testing and example

KirstenS: /* Brief Summary */

2008-12-14T02:38:10Z

‎Brief Summary

Mmeucci at 14:23, 2 November 2008

2008-11-02T14:23:43Z

2a373 at 23:06, 19 September 2008

2008-09-19T23:06:24Z

2a373 at 23:05, 19 September 2008

2008-09-19T23:05:06Z

Mmella: /* Black Box testing and example */

2008-09-13T06:54:50Z

‎Black Box testing and example

@@ Line 45: / Line 45: @@
   ...
-We find 4 operations and not only 3. Using the WebScarab Web Service  plugin, we can craft a SOAP Request to get the Credit Card given a specific ID.
+We find four operations and not only three. Using the WebScarab Web Service  plugin, we can craft a SOAP Request to get the Credit Card given a specific ID.
 <center>
 [[Image:WSDLWebScarab.png]]
@@ Line 93: / Line 93: @@
 '''WSDigger'''
 <br>
-WSDigger is a free open source tool to automate web services security testing.<br>
+WSDigger is a free open source tool to automate web services security testing.
 With this tool we can test our  web services interacting with them through a simple interface, to enter search queries and invoke web services dynamically, without writing code.<br>
 <center>
 [[Image:wsdigger_part.jpg]]

@@ Line 13: / Line 13: @@
 '''Example:'''
 A good example is WebGoat 5.0 WSDL Scanning lesson. The following is a screenshot from that lesson:<br>
 <center>

@@ Line 10: / Line 10: @@
 Given the Standard SOAP message that the Web services supplier waits for the Web services consumer, you can craft a particular message that invoke some hidden operations.
-'''Example:'''<br>
 A good example is WebGoat 5.0 WSDL Scanning lesson. The following is a screenshot from that lesson:<br>
 <center>

@@ Line 9: / Line 9: @@
 == Black Box testing and example ==
-Given the Standard SOAP message that the Web services supplier waits from Web services consumer, you can craft a particular message that invoke some hidden operations.
+Given the Standard SOAP message that the Web services supplier waits for the Web services consumer, you can craft a particular message that invoke some hidden operations.
 '''Example:'''<br>
 A good example is WebGoat 5.0 WSDL Scanning lesson. The following is a screenshot from that lesson:<br>
@@ Line 42: / Line 42: @@
   ...
-We find 4 operations and not only 3. Using WebScarab Web Service  plugin, we can craft a SOAP Request to get the Credit Card given a specific ID.
+We find 4 operations and not only 3. Using the WebScarab Web Service  plugin, we can craft a SOAP Request to get the Credit Card given a specific ID.
 <center>
 [[Image:WSDLWebScarab.png]]
@@ Line 91: / Line 91: @@
 <br>
 WSDigger is a free open source tool to automate web services security testing.<br>
-With this tool we can test our  web services interacting with them trough a simple interface
+With this tool we can test our  web services interacting with them through a simple interface, to enter search queries and invoke web services dynamically, without writing code.<br>
-When we interact with the web service malicious data has been entered into WSDigger the web service method must be invoked by clicking on the invoke button.
+When we interact with the web service malicious data has been entered into WSDigger, and the web service method must be invoked by clicking on the invoke button.
 <br>
 <center>
@@ Line 105: / Line 104: @@
 '''Result expected:'''<br>
 The tester should include full details of where the web service application permits access to an operation that is not used during normal SOAP messages and that provides access to confidential data.
 == References ==

@@ Line 2: / Line 2: @@
 == Brief Summary ==
-Once that the WSDL is identified, we can test that entry point.
+Once the WSDL is identified, we can test that entry point.
 == Description of the Issue ==

← Older revision	Revision as of 23:41, 15 December 2008
(No difference)

← Older revision		Revision as of 14:23, 2 November 2008
Line 106:		Line 106:

	The tester should include full details of where the web service application permits access to an operation that is not used during normal SOAP messages and that provides access to confidential data.		The tester should include full details of where the web service application permits access to an operation that is not used during normal SOAP messages and that provides access to confidential data.
		+
		+	== References ==

	'''Whitepapers'''<br>		'''Whitepapers'''<br>

@@ Line 94: / Line 94: @@
 and allows to search query and invoke web services dynamically without writing code.<br>
-When we intercat with the web service malicious data has been entered into WSDigger the web service method must be invoked by
+When we interact with the web service malicious data has been entered into WSDigger the web service method must be invoked by clicking on the invoke button.
 <br>
 <center>

← Older revision		Revision as of 06:54, 13 September 2008
Line 102:		Line 102:
	<br>		<br>

−	~~Using this tool we can insert a malicious data into web service method and see the results in the output of WSDigger interface.~~
−	~~<br>~~
−
−	~~WSDigger contains also sample attack plug-ins for:~~
−	* SQL injection
−	* cross site scripting
−	* XPATH injection attacks
−
−	~~<br>~~
−	~~<center>~~
−	~~[[Image:wsdigger_attack.jpg]]~~
−	~~<br>~~
−	~~</center>~~
−
−	~~<br>~~

	'''Result expected:'''<br>		'''Result expected:'''<br>