312-50 Question 343
Single answer▪ Attack Web ServicesDuring an authorized assessment, you are testing a SOAP-based customer portal that exposes a WSDL file at https://portal.example.com/OrderService?wsdl. The service accepts XML requests over HTTPS and updates order records in a backend database. While reviewing a sample request in Burp Suite, you notice that the application reflects user-supplied values inside XML elements and returns verbose parser errors when the XML is malformed. You want to determine whether the web service is vulnerable to XML External Entity (XXE) injection without causing destructive impact. Which action is the MOST appropriate next step?
- A
Modify the SOAP request to include a DOCTYPE declaration with an external entity referencing a harmless local file or a controlled out-of-band endpoint, then observe whether the parser resolves the entity
- B
Replace the XML body with JSON parameters and look for differences in HTTP status codes to confirm whether the SOAP parser is vulnerable to XXE
- C
Send repeated oversized SOAP attachments to exhaust server resources because denial-of-service behavior is the most reliable way to confirm XXE
- D
Attempt SQL injection in the SOAPAction HTTP header because SOAP services commonly pass that header directly into backend SQL queries
Show answer and explanation
Correct answer: A
Explanation
This scenario is specifically about attacking web services that process XML, making XXE the most relevant issue to test. SOAP uses XML envelopes, and a WSDL-exposed service commonly accepts structured XML input that may be parsed by libraries with insecure defaults if not hardened. The key clues are: the application is SOAP-based, accepts XML, reflects user-controlled values in XML elements, and returns verbose parser errors when malformed XML is submitted. Those indicators justify controlled XXE validation.
The best practice is to test safely and specifically. A tester should craft a SOAP request that introduces a DOCTYPE and external entity, then determine whether the parser resolves it, ideally using a controlled out-of-band interaction or another non-destructive technique approved in scope. This aligns with secure testing guidance from sources such as the OWASP Web Security Testing Guide and OWASP XXE Prevention guidance, which emphasize that XML parsers should disable DTD processing and external entity resolution unless explicitly required. The distractors are plausible because web services can suffer from many flaws, including SQL injection and denial-of-service conditions, but they do not appropriately address the evidence in this scenario or represent the most direct, low-impact method for validating an XXE weakness.
- A. Correct.
Correct. XXE testing in XML-based web services typically involves inserting a DOCTYPE declaration and defining an external entity, then referencing that entity from an XML element to see whether the parser expands it. Using a harmless target, such as a benign local file in a controlled lab or, more safely in many professional engagements, a controlled out-of-band listener, is the appropriate way to validate parser behavior with minimal impact. SOAP services are XML-based, and verbose parser errors can indicate that XML parsing is occurring in a way that may be susceptible if external entities are enabled.
- B. Incorrect.
Incorrect. SOAP web services expect XML envelopes, not JSON bodies, so replacing the request body with JSON would primarily test input handling or content-type enforcement rather than XXE. A change in HTTP status code would not meaningfully confirm external entity expansion and could lead to a false conclusion.
- C. Incorrect.
Incorrect. Sending oversized payloads or attachment-based resource exhaustion attempts is closer to denial-of-service testing and is not an appropriate first step to validate XXE. It is unnecessarily disruptive and does not specifically prove that external entities are being resolved. In an authorized assessment, testers should prefer precise, low-impact techniques before any potentially disruptive testing.
- D. Incorrect.
Incorrect. SQL injection can exist in web services, but targeting the SOAPAction header is not the most appropriate next step for an XXE hypothesis. SOAPAction is an HTTP header used by some SOAP implementations to indicate the intent of the SOAP request; it is not inherently mapped into SQL queries. The scenario points to XML parser behavior, making XXE-focused testing the logical next step.