Navigation



WSFuzzer – Web Services Fuzzing Tool for HTTP and SOAP

Last updated: September 9, 2015 | 12,426 views

WSFuzzer is a fuzzing tool targetting HTTP and SOAP based web services.

The program currently targets Web Services. In the current version HTTP based SOAP services are the only supported targets. This tool was created based on, and to automate, some of the manual SOAP pen testing work we perform. This tool is NOT meant to be a replacement for solid manual human analysis. Please view WSFuzzer as a tool to augment analysis performed by competent and knowledgeable professionals. Web Services are not trivial in nature so expertise in this area is a must for proper pen testing.

In talking to users of the program it has come to my attention that a note must be made about the results generated from a WSFuzzer run. Be advised that WSFuzzer does not currently do any analysis of the results gathered. That job is yours as the analyst/engineer running the program during a pen test.

Features

  • Attacks a web service based on either valid WSDL, a valid endpoint & namespace, or it can try to intelligently detect WSDL for a given target. As of version 1.6 WSFuzzer includes a simple TCP port scanner.
  • It gives you the ability to handle methods with multiple parameters. Each parameter is handled as a unique entity and can either be attacked or left alone. As of version 1.8.1 this was taken one step further, there are now 2 modes of attacking parameters. The traditional mode is unchanged and is now called “individual” mode due to the fact that each param is fuzzed individually. The new mode is “simultaneous” and attacks multiple parameters simultaneously with a given data set. See the usage examples below for more info.
  • The fuzz generation (attack strings) consists of a combination of a dictionary file, some optional dynamic large injection patterns, and some optional method specific attacks including automated XXE and WSSE attack generation.
  • The tool provides the option of using some IDS Evasion techniques which makes for a powerful security infrastructure (IDS/IPS) testing experience.
  • A time measurement of each round trip between request and response is now provided to aid in results analysis.

WSFuzzer is a dangerous tool so be forewarned, you can easily bring down your target if it susceptible to any of the attack vectors generated and sent in.

You can download WSFuzzer here:

WSFuzzer version 1.9.2.1

Or read more here.

Share1
Tweet
Share
Buffer
WhatsApp
Email
1 Shares
Posted in: Hacking Tools, Web Hacking

, , , , ,


Latest Posts:


Aclpwn.Py - Exploit ACL Based Privilege Escalation Paths in Active Directory Aclpwn.Py – Exploit ACL Based Privilege Escalation Paths in Active Directory
Aclpwn.py is a tool that interacts with BloodHound< to identify and exploit ACL based privilege escalation paths.
July 7, 2021 - 66 Shares
Vulhub - Pre-Built Vulnerable Docker Environments For Learning To Hack Vulhub – Pre-Built Vulnerable Docker Environments For Learning To Hack
Vulhub is an open-source collection of pre-built vulnerable docker environments for learning to hack. No pre-existing knowledge of docker is required, just execute two simple commands.
May 27, 2021 - 209 Shares
LibInjection - Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) LibInjection – Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS)
LibInjection is a C library to Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) through lexical analysis of real-world Attacks.
May 7, 2021 - 90 Shares
Grype - Vulnerability Scanner For Container Images & Filesystems Grype – Vulnerability Scanner For Container Images & Filesystems
Grype is a vulnerability scanner for container images and filesystems with an easy to install binary that supports the packages for most major *nix based OS.
April 19, 2021 - 199 Shares
APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.
March 5, 2021 - 225 Shares
GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc
February 3, 2021 - 153 Shares


Comments are closed.