Downloaded 56 times
![Every WCF Service has a Unique Address Transport Protocol Location Often use .svc file extension when hosted in IIS [transport]://[machine or domain][:optional port]/[optional uri]](https://image.slidesharecdn.com/wcfsecurity-110315064619-phpapp02/85/Web-Service-Security-11-320.jpg)
![Nabarun Sengupta Senior Test Engineer, Mindtree Limited Email Id: [email_address] Mobile: 9689881811](https://image.slidesharecdn.com/wcfsecurity-110315064619-phpapp02/85/Web-Service-Security-24-320.jpg)
Uploaded byn|u - The Open Security Community
Web Service Security
The document discusses testing the security of web services. It provides an overview of Windows Communication Foundation (WCF), explaining that it is Microsoft's framework for building networked applications and supports different protocols. It also discusses important concepts for WCF like addresses, bindings and contracts. The document then provides recommendations for tools to test WCF services, including WcfTestClient, WCF Storm and WSFuzzer, and discusses techniques like leveraging metadata and secure bindings.
More Related Content
More from n|u - The Open Security Community
Web Service Security
- 1.
- 2. Member of securitycommunity – Null I am working at Mindtree Limited Champion of Security Square Like Hacking Executed 6 security projects Tested web services for ASMX, Java web service and WCF. Currently working on: Web services Security Testing
- 3. Web Services StackWCF Story WCF Overview ASP.NET v/s WCF What is New in WCF? ABC of WCF endpoints WCF Attack- Reconnaissance Obtaining Meta Data from WCF service Manual Testing Utilities
- 4.
- 5. Born in 2006,initially code named as Indigo
- 6. Replacement fortraditional ASP .NET web services WCF is a framework that Microsoft is encouraging developers for any kind of network communication. It was introduced in .NET 3.0 Bunch of different protocols and message formatting options. Accordance to SOA principles to support distributed computing
- 7. ASP .NET webservice WCF web service Solely made for building Web service Provides tools for use in any circumstances for s/w entities to communicate Support sending message via HTTP Support formats like HTTP, TCP, named pipes, Microsoft Message Queuing More rich facilities for deploying and managing applications Configuration system Addition to Config system, Config editor, Activity tracing, trace viewer, message logging, a vast no. of performance counters, support for Windows Management Instrumentation
- 8.
- 9.
- 10. WCF has anextension of .svc in comparison to the historically .asmx extension WCF Services are exposed through Endpoints Before attacking WCF, some pre-requisites that should be known are the ABC’s of WCF Web services: Address Binding Contract
- 11. Every WCF Servicehas a Unique Address Transport Protocol Location Often use .svc file extension when hosted in IIS [transport]://[machine or domain][:optional port]/[optional uri]
- 12. “ What protocolcan I use to talk to this service?” Binding specify how a service communicate Transport Protocol Encoding (Message Format) Customized or several out of box bindings
- 13. “ What canI do with this service?” WCF Contracts specify what is communicated outside the world 4 types of Contracts Service: Operations that client can perform Data: Define the data types passed by the service Fault: Error handling and propagation Message: Allows direct interaction with messages.
- 14. Traditional use ofWSDL (can be easily exposed through ?wsdl or /wsdl ) Preferred mechanism for Metadata exchange (MEX) Bad news- Secure approach is implemented in new WCF technologies Good News- Most of the applications are built in VSTS *
- 15. Both WSDL andMEX are enabled by default when generating WCF configuration in Visual Studio
- 16.
- 17. Note: MetaData notalways published over SSL Default Visual Studio Template includes But Not
- 18.
- 19. Leveraging MetaData forManual Testing. WcfTestClient Ships with Visual Studio 2008+ Automatically Parses WSDL or MEX http://weblogs.asp.net/blogs/guillermo/Code/WcfTestClient.zip WCF Storm Supports most WCF bindings, including MC-NBFS over Http Free Lite version available http://www.wcfstorm.com/wcf/download-wcfstorm-lite.aspx
- 20. Pros Has supportfor ASMX, WCF and Java web services Easy GUI Inbuilt Soap generator Cons Commercial tool Trial edition does not provide automation of injection list.
- 21. WSFUZZER is atool developed by Andres Andrew. Built in Python. Needs Jdk 1.6 and Python 2.6 as a pre-requisite Helps in automating payload injections against a WSDL url Useful for automating for XSS, SQL injection, Insecure IDs and Malicious command injection.
- 22. Secure bindings supportMessage Security based on WS-Security standards NetTCPBinding Binary XML Message Format wsHttpBinding SOAP/XML over HTTP/S many more… Multiple credentials options Windows, Certificate, Username, Anonymous, IssuedToken
- 23.
- 24. Nabarun SenguptaSenior Test Engineer, Mindtree Limited Email Id: [email_address] Mobile: 9689881811
Editor's Notes
- #7 The Windows Communication Foundation (or WCF) is an application programming interface (API) in the .NET Framework for building connected, service-oriented applications.
- #8 Reference: http://msdn.microsoft.com/en-us/library/aa480155.aspx Trace viewer is a utility to easily navigate through WCF service call log files. Trace viewer provides details about different parameters of WCF servoce call for ex: request, response, exception etc. Config editor allows to configure different options in a config file for WCF services using UI.
- #11 Difference between asmx and wcf http://www.aspdotnetarchitect.com/post/WCF-versus-ASMX-services.aspx
- #14 Service Contract : Describes which operation the client can perform on the– This attribute is used to define the method inside the interface. service. There are two types of Service Contracts. The Service contract – The attribute is used to define the interface. Operation Contract Data Contract : Which data types are passed to and fro from the service. WCF defines implicit contracts for built in types such as int and string, but we can easily define explicit opt – in data contracts of custom types. There are 2 types of Data Contract. Data Contract- attribute used to define the class. Data Member – attribute used to define the properties If a DataMember attributes are not specified for a properties in the class, that property can’t be passed to-from web service Fault Contracts – Define which errors are raised by the service, and how the service handles and propagates errors to its client. Message Contracts – Allow the service to interact directly with the messages. Message contract can be typed or untyped.
- #15 * If a developer is using VSTS as his/her development platform by default the web.config template that is generated has the metadata enabled in it by default. It even tells you to avoid exposing the metadata.
- #17 WCF publishes MEX with a /MEX request. This can be done by a POST request with a /MEX endpoint. WSDiscovery which released with version 4 also helps in discovering the endpoints. This works like all the services that become up or down broadcast over UDP with a hello or bye message. WSDiscovery intercepts these messages to identify whether the servoces are up or not. There are 2 communication mode for this :Adhoc and Managed mode. The difference is in the managed mode there is a central repository which keeps a log of all these helo and bye UDP requests