312-50 Question 28
Single answer▪ Footprinting through Web ServicesDuring a permitted reconnaissance phase, you are asked to gather information about a target organization's externally exposed web services without performing intrusive testing. You discover that https://api.example.com hosts a SOAP-based service. To identify available operations, message formats, and service endpoints in a low-impact way, which action is the MOST appropriate?
- A
Retrieve and review the service's WSDL document from the web service endpoint
- B
Launch a brute-force attack against the SOAP authentication mechanism to enumerate valid users
- C
Send malformed XML payloads repeatedly to trigger verbose fault messages and disclose backend details
- D
Run a full SQL injection test suite against all SOAP parameters to map the database schema
Show answer and explanation
Correct answer: A
Explanation
For footprinting through web services, the goal is to collect information exposed by the service itself, such as interfaces, operations, schemas, and endpoints, without crossing into intrusive testing. For SOAP services, the WSDL is the primary source of this information and is commonly available through the service URL or a related descriptor path. It can reveal operation names, input/output parameters, protocol bindings, and service locations, all of which are valuable during reconnaissance. This aligns with standard SOAP and WSDL usage defined by the W3C and with ethical assessment best practices that emphasize staying within the agreed scope and minimizing operational impact during recon. By contrast, brute-forcing, malformed request fuzzing, and SQL injection testing move from footprinting into active attack or vulnerability testing.
- A. Correct.
Correct. In SOAP-based web services, the Web Services Description Language (WSDL) document is specifically designed to describe the service interface, including available operations, message structures, bindings, and endpoint locations. Reviewing the WSDL is a standard, low-impact footprinting technique because it uses intended service metadata rather than exploitative behavior. In a CEH context, this is the most appropriate method for enumerating web service functionality during reconnaissance.
- B. Incorrect.
Incorrect. Brute-forcing authentication is an active attack, not a footprinting technique. It is intrusive, may violate rules of engagement, and is unnecessary when the objective is simply to identify available operations and service structure. A candidate might choose this because user enumeration is a common recon goal, but it does not align with low-impact web service footprinting.
- C. Incorrect.
Incorrect. Intentionally sending malformed XML to elicit verbose errors is more aggressive than passive or low-impact footprinting and can affect service stability or trigger alerts. While error messages sometimes reveal implementation details, this approach is not the most appropriate first step when the task is to gather information non-intrusively.
- D. Incorrect.
Incorrect. SQL injection testing is vulnerability assessment or exploitation activity, not basic footprinting. It is also unnecessarily invasive for the stated objective. Someone might pick this option because backend schema discovery can reveal useful information, but it exceeds the scope of identifying service operations and interfaces through web services.