CAPEC-279: SOAP Manipulation
Simple Object Access Protocol (SOAP) is used as a communication protocol between a client and server to invoke web services on the server. It is an XML-based protocol, and therefore suffers from many of the same shortcomings as other XML-based protocols. Adversaries can make use of these shortcomings and manipulate the content of SOAP paramters, leading to undesirable behavior on the server and allowing the adversary to carry out a number of further attacks.
Last updated
Overview
CAPEC-279 (SOAP Manipulation) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
How the attack works
The phases an attacker typically follows to carry out this attack.
- Step 1Exploit
[Find target application] The adversary needs to identify an application that uses SOAP as a communication protocol.
- Observe HTTP traffic to an application and look for SOAP headers.
- Step 2Experiment
[Detect Incorrect SOAP Parameter Handling] The adversary tampers with the SOAP message parameters and looks for indications that the tampering caused a change in behavior of the targeted application.
- Send more data than would seem reasonable for a field and see if the server complains.
- Send nonsense data in a field that expects a certain subset, such as product names or sequence numbers, and see if the server complains.
- Send XML metacharacters as data and see how the server responds.
- Step 3Exploit