Comments on: WSBang – Python Based SOAP Services Testing Tool

By: Saam Choy

Saam Choy — Sat, 19 Jan 2008 20:56:26 +0000

All of the tools mentioned are pretty good but really dont address SOAP security testing in its entirety. That is why many tools must be combined with solid manual testing. Also check out OWASP’s WSFuzzer as it does nasty testing against SOAP services. Their XML Fuzz Generator class is pretty interesting and worth analyzing. That neurofuzz team also has text web services on their site. xmethods also has tons of free services you can mess with.

By: CG

CG — Thu, 15 Nov 2007 04:11:27 +0000

Does anyone know of any good test sites for SOAP/WSDL or have some instructions on building one. that’s really the big issue with all these cool SOAP fuzzers and auditing tools that there arent too many places running running apps you can play with.

guess i need to get off my butt and build one…

By: dirty

dirty — Thu, 08 Nov 2007 16:05:19 +0000

fazed:
I know what you mean about SOAP. Never get a chance to do anything with it, customers not using it.

By: fazed

fazed — Thu, 08 Nov 2007 01:22:05 +0000

nice tool, w3af is good. :)
I don’t usually do anything with SOAP.

By: dirty

dirty — Wed, 07 Nov 2007 20:58:42 +0000

darknet
sorry, sometimes i forget where i have read about something (w3af). BTW a new version (Beta5) is out since the last time darknet reported on it…..

By: Darknet

Darknet — Wed, 07 Nov 2007 06:17:20 +0000

dre: Yeah they have some pretty cool Python based stuff, I have a draft on untidy which is pretty useful – I haven’t really checked out an of the others yet. Will look at wsScanner.

dirty: We have written about w3af before :)

By: dirty

dirty — Tue, 06 Nov 2007 18:07:18 +0000

havent got a chance to test this out but seems interesting…btw…the isec website has a lot of free python based tools available.

the author, Andres Riancho, of untidy also wrote w3af (http://w3af.sourceforge.net/)
w3af is a Web application attack and Audit Framework. The project goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend.

By: dre

dre — Tue, 06 Nov 2007 17:21:33 +0000

WSBang and the iSecPartners' tools are nice. Most recently, I have been using SOAPSonar Enterprise from Crosscheck Networks because of its inclusion of a very nice vulnerability assessment engine, as well as support for almost everything related to web services. The Personal Edition is also downloadable for free. For general XML fuzzing - check out untidy. Another tool worth mentioning is wsScanner from BlueInfy, whose creator - Shreeraj Shah - wrote the book on Hacking Web Services