The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 9 

■

Injecting Code

315

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 315

---

If SOAP injection is difficult to detect, then it can be even harder to exploit.

In most situations, you will need to know the structure of the XML that sur-

rounds your data, in order to supply crafted input which modifies the message

without invalidating it. In all of the preceding tests, look for any error mes-

sages that reveal any details about the SOAP message being processed. If you

are lucky, a verbose message will disclose the entire message, enabling you to

construct crafted values to exploit the vulnerability. If you are unlucky, you

may be restricted to pure guesswork, which is very unlikely to be successful.