performing-soap-web-service-security-testing - Test SOAP web services for security vulnerabilities
Analyzes WSDL definitions and tests SOAP services for XML injection, XXE, WS-Security bypass, SOAPAction spoofing, and related security issues.
Tags
Updated: 2026-10-01Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Analyze WSDL definitions
- Enumerate SOAP operations
- Test XXE vulnerabilities
- Test SQL injection
- Test XPath injection
- Test XML bombs
- Assess WS-Security controls
- Test SOAPAction spoofing
- Assess authentication controls
- Assess authorization controls
Inputs
- SOAP service endpoint URL
- WSDL file or URL
- Testing authorization
Outputs
- SOAP operation listings
- HTTP responses
- Vulnerability test results
- Security findings
- Response timing observations
Requirements
- SoapUI or ReadyAPI
- Burp Suite with SOAP extensions
- Python 3.8 or later
- zeep and lxml libraries
- Authorized security testing access