Does anyone know how to perform penetration testing/vulnerability assessment for Microsoft WCF services I couldn't find a tools till now , any tools available and guides are welcome
1
-
3Related: Is WCF or Java Metro security configuration in-scope for your security department; should it be?– makerofthings7May 10, 2012 at 17:51
Add a comment
|
1 Answer
Beyond basic SOAP fuzzers there aren't too many advanced tools useful for pen testing of a WCF service. Since WCF/SOAP is really just a front for the underlying API you've written, you really need a tool to assess the vulnerabilities in your API, which is usually something of a custom nature.
There are tools out there like FxCop which have a very simple baseline for security analysis, but you can't rely on it entirely.
There's a great intro presentation on the OWASP site by Brian Holyfield about pen testing WCF services here: https://www.owasp.org/images/6/6c/Attacking_WCF_Web_Services-Brian_Holyfield.pdf. He lists a couple tools, but they aren't WCF/SOAP specific.
-
i found this to be useful also gremwell.com/blog/pentesting_silverlight_and_wcf_ria what do you think May 13, 2012 at 11:53
-
The tools it lists are pretty good. They are normally used for regular testing.– SteveMay 14, 2012 at 15:20