Web services allow different applications to communicate over the web using XML. They operate on the server side and can perform tasks when called by client applications. While web services provide application integration, they also present some security concerns like buffer overflows, XML injections, and session hijacking that could allow attackers to damage systems or steal data. Tools are available to help secure web applications and detect vulnerabilities in web services.

1. WEB SERVICES
The Technology
& Its Security Concerns

2. Before Web Services
 Application-to-application integration was an
issue which required a solution.
 Web Service act as a middle agent between
two different applications.

3. Definition
 Deducing from previous facts,we define Web
Service as one which provides a web API that
enables two applications to communicate
using XML over web.
 It s architecture comprises of different
technologies which enables a client to obtain
data from server using SOAP protocol.

4. Salient Features
 Operates on server side.
 Performs a task when called by an
application(client).
 Can be developed in any language.
 Can be deployed on any platform.
 Most imp.-It can be accessed by any
application regardless of language used to
develop that application.

5. Building Blocks
 A Web Service is registered in a Web Service
registry-UDDI Provider.
 It is a central directory containing all service
descriptions.
 An application uses it to call the specific
service it requires.
 Web Service uses XML to communicate with
other services or applications.

6. Web Service in action

7. Security Concerns
Three major methods attack found on Web
Services are-
 Buffer Overflows
 XML Injections
 Session Hijacking

8. Security Concerns…
BUFFER OVERFLOWS
• Common effects include DOS,data
corruption,malicious code execution
• DOS attack-Forcing a server to parse an
abnormally long XML file.
• Another attack can be sending a block of data
to an application which is stored in a buffer of
insufficient size.

9. Security Concerns…
XML INJECTIONS
• Common effects include schema poisoning ,
data theft & deletion
• SQL injection is a threat to server if data is
not validated.
• Schema file is used by XML parser to interpret
XML’s grammar & structure. An attacker may
damage or replace original schema.

10. Security Concerns…
SESSION HIJACKING
• Common effects include obtaining of user
privileges within network or application.
• An attacker can intercept SOAP messages &
thus hijack a user’s session.

11. Conclusion
 Web services allow many technologies to
collaborate & communicate with each other.
 Some tools developed to detect
vulnerabilities & securing web applications
include Web vulnerability scanner,Web
services scanning tool,Web service editor etc.