Web Service Security Testing Cheat Sheet - Revision history

Dominique RIGHETTO: Migration to GitHub of the project

2019-02-16T10:28:03Z

Migration to GitHub of the project

Show changes

Dominique RIGHETTO: Add the DELETE marker. Refer to CS cleanup phase

2018-08-25T09:27:06Z

Add the DELETE marker. Refer to CS cleanup phase

Rick.mitchell: Add ZAP to tools list

2016-05-11T12:08:38Z

Add ZAP to tools list

Michael Born at 19:43, 24 August 2015

2015-08-24T19:43:18Z

Jmanico at 19:35, 4 August 2015

2015-08-04T19:35:58Z

Jmanico at 19:35, 4 August 2015

2015-08-04T19:35:45Z

Jmanico at 19:33, 4 August 2015

2015-08-04T19:33:46Z

Jmanico at 19:32, 4 August 2015

2015-08-04T19:32:48Z

Jmanico at 19:32, 4 August 2015

2015-08-04T19:32:12Z

Jmanico at 19:31, 4 August 2015

2015-08-04T19:31:38Z

← Older revision		Revision as of 09:27, 25 August 2018
Line 213:		Line 213:

	[[Category:Cheatsheets]]		[[Category:Cheatsheets]]
		+
		+	{{taggedDocument\| type=delete\| comment=Tagged via fixme/delete.}}

@@ Line 72: / Line 72: @@
 ** Tools<br />
 *** SoapUI Pro<br />
 *** IBM AppScan<br />
 *** HP Webinspect<br />

@@ Line 51: / Line 51: @@
 ** Authentication Type Discovery<br />
 ** REST vs. SOAP<br />
 * Grey Box<br />
 ** WSDL file contents<br />
 *** Methods<br />
 *** Data Types<br />
-** Sample Requests<br />
+** Sample/Baseline Requests<br />
 *** Methods<br />
 *** Data Types<br />

@@ Line 3: / Line 3: @@
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |- | valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
+<br/>Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
   __TOC__{{TOC hidden}}
 = Web Services Security Testing Cheat Sheet Introduction  =

@@ Line 9: / Line 9: @@
 = Web Services Security Testing Cheat Sheet Introduction  =
-<p>As Web Services are incorporated into application environments, having a good checklist while performing security assessments can help a penetration tester better identify web service related vulnerabilities and associated risk.</p>
+As Web Services are incorporated into application environments, having a good checklist while performing security assessments can help a penetration tester better identify web service related vulnerabilities and associated risk.
-<h2>Purpose</h2>
+== Purpose ==
-<p>This document is intended to be an easy to use checklist while performing assessments against web services. The penetration tester is advised to incorporate this into his or her corporate testing methodology as a supplemental checklist or is free to use this checklist as the sole testing guideline.</p><br /><br />
+This document is intended to be an easy to use checklist while performing assessments against web services. The penetration tester is advised to incorporate this into his or her corporate testing methodology as a supplemental checklist or is free to use this checklist as the sole testing guideline.
-<h2>Checklist</h2>
+== Checklist ==
-<h3>Pre-Assessment</h3>
+===Pre-Assessment===
 <p>
 * For a Black Box assessment, at the very least, the penetration tester will need the Web Service Description Language (WSDL) file<br />
@@ Line 23: / Line 23: @@
 </p>
-<h3>Information Gathering</h3>
+===Information Gathering===
 <p>
 * Black Box<br />
@@ Line 65: / Line 65: @@
 </p>
-<h3>Testing Phase</h3>
+===Testing Phase===
 <p>
@@ Line 133: / Line 133: @@
 </p>
-<h2>Testing REST Based Web Services</h2>
+==Testing REST Based Web Services==
-<p>There is already a great cheat sheet on how to properly test the security of REST based web services. You can find the guide at the following location: <br />
+There is already a great cheat sheet on how to properly test the security of REST based web services. You can find the guide at the following location: <br />
-[https://www.owasp.org/index.php/REST_Assessment_Cheat_Sheet] https://www.owasp.org/index.php/REST_Assessment_Cheat_Sheet</p>
+[https://www.owasp.org/index.php/REST_Assessment_Cheat_Sheet] https://www.owasp.org/index.php/REST_Assessment_Cheat_Sheet
-<h2>Testing Summary</h2>
+==Testing Summary==
 <p>While using automated tools, the penetration tester will need to validate all reported findings manually and perform due diligence false positive analysis for each vulnerability reported. During the manual phase of testing, the penetration tester will look for the existence of vulnerabilities missed by the automated tools and will validate automated tool output as necessary.</p>
-<h2>References</h2>
+==References==
 <p>[http://www.securestate.com/Insights/Documents/WhitePapers/Dont-Drop-the-SOAP-Whitepaper.pdf] http://www.securestate.com/Insights/Documents/WhitePapers/Dont-Drop-the-SOAP-Whitepaper.pdf<br />
@@ Line 167: / Line 167: @@
 </p>
-<h2>Additional Resources</h2>
+==Additional Resources==
 <p>Below are resources to help the tester learn and refine their ability to effectively test various web services.</p>
@@ Line 189: / Line 189: @@
 * [https://www.owasp.org/index.php/REST_Assessment_Cheat_Sheet] https://www.owasp.org/index.php/REST_Assessment_Cheat_Sheet</p>
-<h2>Primary Author</h2>
+==Primary Author==
 <p>
 * Michael Born
 </p>
-<h2>Contributing Editors/Authors</h2>
+==Contributing Editors/Authors==
 <p>
 * John Rogers

← Older revision		Revision as of 19:33, 4 August 2015
Line 3:		Line 3:

	{\| style="padding: 0;margin:0;margin-top:10px;text-align:left;" \|- \| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" \|		{\| style="padding: 0;margin:0;margin-top:10px;text-align:left;" \|- \| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" \|
		+

	Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''		Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

@@ Line 1: / Line 1: @@
 <br /><br /><h1>Web Services Security Testing Cheat Sheet</h1>
@@ Line 199: / Line 209: @@
 * Justin Williams
 </p>