the-web-application-hackers-handbook

Chapter 10 n Attacking Back-End Components 389
Finding and Exploiting SOAP Injection
SOAP injection can be difficult to detect, because supplying XML metacharacters
in a noncrafted way breaks the format of the SOAP message, often resulting in
an uninformative error message. Nevertheless, the following steps can be used
to detect SOAP injection vulnerabilities with a degree of reliability.
HACK STEPS
1. Submit a rogue XML closing tag such as in each parameter in turn.
If no error occurs, your input is probably not being inserted into a SOAP
message, or it is being sanitized in some way.
2. If an error was received, submit instead a valid opening and closing tag
pair, such as . If this causes the error to disappear, the
application may be vulnerable.
3. In some situations, data that is inserted into an XML-formatted message
is subsequently read back from its XML form and returned to the
user. If the item you are modifying is being returned in the application’s
responses, see whether any XML content you submit is returned in its
identical form or has been normalized in some way. Submit the following
two values in turn:
test
test
If you find that either item is returned as the other, or simply as test,
you can be confident that your input is being inserted into an XML-based
message.
4. If the HTTP request contains several parameters that may be being placed
into a SOAP message, try inserting the opening comment character () into
another parameter. Then switch these around (because you have no way
of knowing in which order the parameters appear). Doing so can have the
effect of commenting out a portion of the server’s SOAP message. This
may cause a change in the application’s logic or result in a different error
condition that may divulge information.
If SOAP injection is difficult to detect, it can be even harder to exploit. In most
situations, you need to know the structure of the XML that surrounds your data
to supply crafted input that modifies the message without invalidating it. In all
the preceding tests, look for any error messages that reveal any details about
the SOAP message being processed. If you are lucky, a verbose message will
disclose the entire message, enabling you to construct crafted values to exploit
the vulnerability. If you are unlucky, you may be restricted to pure guesswork,
which is very unlikely to be successful.