Welcome readers to Part 2 of Web Services Penetration Testing.
In this part, we will take a quick look into the various test cases, tools, and methods for security testing of Web Services.
Penetration Testing on Web Services:
Testing web services are an important aspect because an attacker potentially is able to attack vulnerabilities within the web service to bypass controls within the application. During penetration testing, it often found that these services are configured outside the protections within the web applications. For web services, it is necessary to ensure that any data being transmitted between a user and web services is protected from being intercepted by malicious attackers. There are various vulnerabilities can be found due to lack of security implemented on web services such as:
Black box Web Services Penetration Testing pre-requisite:
A Web Service Description Language (WSDL) file would be required to perform black-box Webservice API penetration testing
Grey box Web Services Penetration Testing pre-requisite:
In case of grey box webservice API penetration testing a Sample requests and responses for methods along with the WSDL file is required to perform the webservice API penetration testing.
Stages of Penetration Testing of Web Service:
Web Service Penetration Testing Tools: Tools play an important role in performing penetration testing on web services. We have two types of testing tools Automated and manual to perform API security penetration testing.
Automated Testing Tools
Manual Testing Tools
Test cases to find in web services:
Let’s now take a look at how to perform an automated scan using SOAP UI and get a preliminary first-hand security report of the web services.
Using SOAP UI Pro for security assessments:
1. Fire up SOAP UI and create a functional test case
2. Add security test
3. Select the “Auto” mode to generate default Security Scans and Assertions for the TestSteps in your TestCase and press “Next”:
4. Press OK to create the Security Test with the described configuration and open the Security Test window:
5. Now run the security test
6. Post the security scan, you can dig deeper into the output or generate reports also for your assessment.
Practice VMS for vulnerable web services:
Part 3 of this series will focus on using a burp suite+ postman along with SOAP UI for manual testing of web services.
References and sources