The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

True

--&ToAccount=-->

08447656

&Submit=Submit

A further type of attack would be to attempt to complete the entire SOAP

message from within an injected parameter and comment out the remainder of

the message. However, because the opening comment will not be matched by

a closing comment, this attack produces strictly invalid XML, which will be

rejected by many XML parsers:

POST /transfer.asp HTTP/1.0

Host: wahh-bank.com

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 314

---

Content-Length: 176

FromAccount=18281008&Amount=

1430True

s>08447656


Envelope>

--&Submit=Submit

Finding and Exploiting SOAP Injection

SOAP injection can be difficult to detect, because supplying XML metacharac-

ters in a noncrafted way will break the format of the SOAP message, and this

will often simply result in an uninformative error message. Nevertheless, the

following steps can be used to detect SOAP injection vulnerabilities with a

degree of reliability.

HACK STEPS

■

Submit a rogue XML closing tag such as