Security Testing - Web Service

In modern web-based applications, the usage of web services is inevitable and they are prone for attacks as well. Since the web services request fetch from multiple websites developers have to take few additional measures in order to avoid any kind of penetration by hackers.

Hands ON

Step 1 − Navigate to web services area of Webgoat and go to WSDL Scanning. We need to now get credit card details of some other account number. Snapshot of the scenario is as mentioned below.

Step 2 − If we select the first name, the 'getFirstName' function call is made through SOAP request xml.

Step 3 − By opening the WSDL, we are can see that there is a method to retrieve credit card information as well 'getCreditCard'. Now let us tamper the inputs using Burp suite as shown below −

Step 4 − Now let us modify the inputs using Burp suite as shown below −

Step 5 − We can get the credit card information of other users.

Preventive Mechanisms

• Since SOAP messages are XML-based, all passed credentials have to be converted to text format. Hence one has to be very careful in passing the sensitive information which has to be always encrypted.

• Protecting message integrity by implementing the mechanisms like checksum applied to ensure packet's integrity.

• Protecting message confidentiality - Asymmetric encryption is applied to protect the symmetric session keys, which in many implementations are valid for one communication only and are discarded subsequently.