the-web-application-hackers-handbook

Chapter 21 n A Web Application Hacker’s Methodology 839
8.3 Test for SOAP Injection
8.3.1 Target each parameter in turn that you suspect is being processed via
a SOAP message. Submit a rogue XML closing tag, such as . If
no error occurs, your input is probably not being inserted into a SOAP
message or is being sanitized in some way.
8.3.2 If an error was received, submit instead a valid opening and closing
tag pair, such as . If this causes the error to disappear, the
application may be vulnerable.
8.3.3 If the item you submit is copied back into the application’s responses,
submit the following two values in turn. If you find that either item is
returned as the other, or as simply test, you can be confident that your
input is being inserted into an XML-based message.
test
test
8.3.4 If the HTTP request contains several parameters that may be being
placed into a SOAP message, try inserting the opening comment character
into another parameter. Then switch these (because you have no way
of knowing in which order the parameters appear). This can have the
effect of commenting out a portion of the server’s SOAP message, which
may change the application’s logic or result in a different error condition
that may divulge information.
8.4 Test for LDAP Injection
8.4.1 In any functionality where user-supplied data is used to retrieve information
from a directory service, target each parameter in turn to test
for potential injection into an LDAP query.
8.4.2 Submit the * character. If a large number of results are returned, this is
a good indicator that you are dealing with an LDAP query.
8.4.3 Try entering a number of closing parentheses:
))))))))))
This input invalidates the query syntax, so if an error or other anomalous
behavior results, the application may be vulnerable (although many
other application functions and injection situations may behave in the
same way).
8.4.4 Try entering various expressions designed to interfere with different
types of queries, and see if these allow you to influence the results being