312-50 Question 30
Single answer▪ Footprinting through Web ServicesDuring a permitted reconnaissance engagement, you are asked to footprint a target organization's externally exposed web services without actively attacking them. The client wants to know whether any SOAP-based services are publicly reachable and what operations they expose. You have identified a likely service endpoint at https://api.example.com/OrderService. Which action is the MOST appropriate next step to enumerate the service in a low-impact, standards-based way?
- A
Request https://api.example.com/OrderService?wsdl to retrieve the WSDL and review the available operations and bindings
- B
Run a directory brute-force attack against the entire api.example.com host to discover hidden SOAP methods
- C
Send SQL injection payloads in SOAP parameters to force verbose database errors that reveal the service schema
- D
Capture and crack NTLM authentication traffic from the web service to identify backend Windows accounts
Show answer and explanation
Correct answer: A
Explanation
For footprinting through web services, the goal is to gather information about exposed services, interfaces, methods, and data formats with minimal impact. In SOAP environments, the WSDL is the primary source for this information because it formally describes the service contract. Reviewing a WSDL can reveal operation names, request/response structures, protocol bindings, and service endpoints, which makes it highly valuable during reconnaissance. This aligns with common web service assessment methodology used in security testing and developer documentation for SOAP/WSDL-based services. By contrast, brute-force discovery is noisier and less targeted, SQL injection is an attack rather than footprinting, and NTLM credential attacks are outside the scope of basic web service enumeration. In practical CEH-style scenarios, identifying and retrieving service descriptions such as WSDL files is a standard and appropriate footprinting technique.
- A. Correct.
Correct. In SOAP-based web services, the Web Services Description Language (WSDL) document is commonly exposed and can often be retrieved by appending ?wsdl to the endpoint URL, depending on the implementation. The WSDL provides structured information about the service, including available operations, message formats, bindings, and endpoints. For a footprinting task, this is a low-impact and standards-based way to enumerate the service without exploiting it.
- B. Incorrect.
Incorrect. Directory brute-forcing may discover files or directories, but it is not the most appropriate next step when the objective is specifically to enumerate a suspected SOAP service in a low-impact manner. SOAP methods are typically described in the WSDL rather than discovered through path brute-forcing. This option reflects a common misconception that all web service enumeration should begin with aggressive content discovery.
- C. Incorrect.
Incorrect. Sending SQL injection payloads moves beyond footprinting into active exploitation. It is not appropriate when the task is to enumerate publicly exposed web services without attacking them. Although verbose errors can reveal schema details in vulnerable applications, using injection payloads is neither standards-based nor low impact.
- D. Incorrect.
Incorrect. Capturing and cracking NTLM traffic is unrelated to ordinary SOAP service footprinting and would require a different attack path and assumptions about authentication mechanisms. This option confuses web service enumeration with credential interception techniques and is not a suitable reconnaissance step for identifying service operations.