Penetration Testing Tool for Web Services Security

Abstract

XML-based SOAP Web Services are a widely used technology, which allows the users to execute remote operations and transport arbitrary data. It is currently adapted in Service Oriented Architectures, cloud interfaces, management of federated identities, eGovernment, or millitary services. The wide adoption of this technology has resulted in an emergence of numerous-mostly complex-extension specifications. Naturally, this has been followed by a rise in large number of Web Services attacks. They range from specific Denial of Service attacks to attacks breaking interfaces of cloud providers [1], [2] or confidentiality of encrypted messages [3]. By implementing common web applications, the developers evaluate the security of their systems by applying different penetration testing tools. However, in comparison to the wellknown attacks as SQL injection or Cross Site Scripting, there exist no penetration testing tools for Web Services specific attacks. This was the motivation for developing the first automated penetration testing tool for Web Services called WS-Attacker. In this paper we give an overview of our design decisions and provide evaluation of four Web Services frameworks and their resistance against WS-Addressing spoofing and SOAPAction spoofing attacks.

SSOAM: Automated Security Testing Framework for SOA Middleware in Banking Domain

“…The presented final results have been proved that WS-attacker can protect web services from SOAPAction, WS-Addressing spoofing, XML rewriting attacks and others refer to Table 1 (Hariharan and Babu, 2014;Mainka et al, 2012).…”

“…This plugin focuses on the individual business process by analyzing the Web Service Description Language (WSDL) file. The main weakness in this plugin, which the author did not consider is that the orchestrated services, located in business process execution language (BPEL) component, could not prevent XML interpreting tags and replay attacks (Hariharan and Babu, 2014;Mainka et al, 2012).…”

“…SOAP is the heart of web services schema, while web services are loosely coupled software components and standard methods for connecting web-based applications such as internet banking to the core-banking system by using XML, SOAP, WSDL and Universal Description, Discovery and Integration (UDDI) over Internet protocol backbone (Mainka et al, 2012):…”

“…• Send a service request from a requestor to the registry • Send information from the registry to the requestor; • Allow the requestor to bind to the service provider and run the web service (Mainka et al, 2012;Al-Jaroodi and Al-Dhaheri, 2011;Bhargavan et al, 2007) It is important to mention that SOAP is essential for all web services and communication between banking eservices (Hariharan and Babu, 2014;Lux et al, 2005;Keen et al, 2017).…”

Evaluating the Security Flaws in Web Applications

“…The SQL injection is the well-known attack [10] against the web programs, has become a serious protection risk..The traditional techniques are insufficient to analyse the SQL injection weak points in the web programs. In comparison to the well-known attacks as SQL injection or XSS, transmission analysing sources for the web services specific attacks do not exist.…”