Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

I'm writing to get some stuff on hardening some web-services, but I'm looking also for some tool to test web-services.

I have a sandbox (can't post live URLs...)

I'm trying some stuff to try to exploit axis/services/AdminService?wsdl

I am looking for a good tool to do this or an article to read to get some extra knowledge about pentesting web-services.

share|improve this question
I removed the link from your post. Whilst it'd be nice if we could all trust arbitrary links in people's questions, this is a security board. I also don't want a spam/malware spider spotting your link and messing up your sandbox. – Polynomial Sep 2 '12 at 9:03
Ok, sry for the link, thanks for the "heads up" – LxFlip Sep 2 '12 at 11:26
About the malware/bots, don't worry, that's the idea also. I've already got some traffice samples from some .ro malware – LxFlip Sep 2 '12 at 11:34

2 Answers

up vote 1 down vote

This looks like .NET WCF / WSDL service, you can access it with Visual Studio but also any other WSDL client would work, but with this one you can actually access all objects, so you can properly hack it. It is created and debugged the same way:

http://www.youtube.com/watch?v=rrdpjrGojO8

Basically in this kind of service, you need to have SSL (HTTPS), Session (which is supported, but you need to make authentication) and Transactions (also supported).

It should not expose any objects or classes by default (in the XML you got with ?wsdl), but only login (authentication). You can wrap it in high level single object and encapsulate other methods to it, so it doesn't expose much, like getCommand().

It can also require certificate on the client side and firewall protection.

For hacking such services, there are not many useful tools, because it depends on how you code it, so you can get any WSDP / SOAP client and check it out yourself.

share|improve this answer
Thanks for the answer, but i still need more stuff. Another detail it's not a microsoft .NET WSDL, it's apache/axis – LxFlip Sep 2 '12 at 12:53
up vote 0 down vote

I've found that metasploit has a scan module that can be put to nice use.

The auxiliary / scan / http soap module can be used to try to enumerate some usefull "hidden" web-services.

share|improve this answer
Can you tell me why the post was edited? it was because i said to post "tools"?? And another thing, i couldn't post links but the guy that posted an answer can post links? – LxFlip Sep 3 '12 at 8:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.