SOAP Automation Framework Support

Mon, 01 Jan 0001 00:00:00 +0000

SOAP Automation Framework Support

This add-on supports the Automation Framework.

The add-on will import WSDL files containing SOAP endpoints if they are found while spidering but adding them explicitly via a URL or local file is recommended if they are available.

Job: soap

The soap job allows you to import WSDL files locally or from a URL.

SOAP Alerts

Mon, 01 Jan 0001 00:00:00 +0000

SOAP Alerts

The following alerts are raised by the SOAP add-on. {#id-90026}{#id-90029}{#id-90030}

Alert Reference	Name	Description	Latest Code
90026	Action Spoofing	SOAP requests contain some sort of operation that is later executed by the web application. This operation can be found in the first child element of the SOAP Body. However, if HTTP is used to transport the SOAP message the SOAP standard allows the use of an additional HTTP header element called SOAPAction. This header element contains the name of the executed operation. It is supposed to inform the receiving web service of what operation is contained in the SOAP Body, without having to do any XML parsing. This optimization can be used by an attacker to mount an attack, since certain web service frameworks determine the operation to be executed solely on the information contained in the SOAPAction header field.	SOAPActionSpoofingActiveScanRule.java
90029	SOAP XML Injection	During an “XML Injection” an attacker tries to add or manipulate various XML Tags in the SOAP message aiming to manipulate the XML structure. Usually a successful XML injection results in the execution of a restricted or unintended operation. Depending on the executed operation various security or business controls might be violated.	SOAPXMLInjectionActiveScanRule.java
90030	WSDL File Detection	This alert is raised when the passive scanner detects a WSDL file.	WSDLFilePassiveScanRule.java

SOAP Support on ZAP

SOAP Automation Framework Support

SOAP Automation Framework Support

Job: soap

SOAP Alerts

SOAP Alerts

See also


	SOAP	for an overview of the SOAP support add-on.
	SOAP Automation	for information about the automation framework support.