1 1 00:00:00,330 --> 00:00:03,990 SOAP, or Simple Object Access Protocol. 2 2 00:00:03,990 --> 00:00:06,180 In this lesson, we're going to talk about SOAP 3 3 00:00:06,180 --> 00:00:08,700 and not the kind that you wash your hands with. 4 4 00:00:08,700 --> 00:00:10,440 Instead, we're going to talk about the thing 5 5 00:00:10,440 --> 00:00:12,660 that allows service-oriented architectures 6 6 00:00:12,660 --> 00:00:15,540 to provide services with access from different sources. 7 7 00:00:15,540 --> 00:00:17,280 Now, when you take all these different services 8 8 00:00:17,280 --> 00:00:18,660 and you try to put them all together 9 9 00:00:18,660 --> 00:00:20,370 and have that loose coupling 10 10 00:00:20,370 --> 00:00:21,840 so that they can actually operate 11 11 00:00:21,840 --> 00:00:23,250 and pass things back and forth, 12 12 00:00:23,250 --> 00:00:24,870 they need a way to communicate. 13 13 00:00:24,870 --> 00:00:25,950 Now, this is really important 14 14 00:00:25,950 --> 00:00:27,180 because when people are building 15 15 00:00:27,180 --> 00:00:28,950 all of these loosely coupled services, 16 16 00:00:28,950 --> 00:00:31,500 they can write them in all sorts of different languages. 17 17 00:00:31,500 --> 00:00:34,320 You might write yours in Java, I might write mine in Python. 18 18 00:00:34,320 --> 00:00:35,850 Somebody else might use JavaScript, 19 19 00:00:35,850 --> 00:00:37,890 somebody else might use Perl or Ruby. 20 20 00:00:37,890 --> 00:00:39,690 And if we want them all to talk to each other, 21 21 00:00:39,690 --> 00:00:41,880 we need a common way to do that. 22 22 00:00:41,880 --> 00:00:44,190 Well, that is what SOAP is really about. 23 23 00:00:44,190 --> 00:00:47,040 SOAP is the Simple Object Access Protocol, 24 24 00:00:47,040 --> 00:00:49,710 and it provides an XML-based web service protocol 25 25 00:00:49,710 --> 00:00:51,930 that's used to exchange these messages. 26 26 00:00:51,930 --> 00:00:53,430 SOAP is going to provide a structure 27 27 00:00:53,430 --> 00:00:55,590 for transmitting and receiving information 28 28 00:00:55,590 --> 00:00:57,300 that's used in these web applications 29 29 00:00:57,300 --> 00:00:59,070 to a variety of device types 30 30 00:00:59,070 --> 00:01:03,180 using an application programming interface, known as an API. 31 31 00:01:03,180 --> 00:01:04,320 Now, when we use SOAP, 32 32 00:01:04,320 --> 00:01:06,810 it's going to help us to support the authentication, 33 33 00:01:06,810 --> 00:01:09,510 the transport security, the asynchronous messaging, 34 34 00:01:09,510 --> 00:01:11,040 and built-in error handling. 35 35 00:01:11,040 --> 00:01:13,590 So it gives us a lot of good benefits. 36 36 00:01:13,590 --> 00:01:14,940 Now, when you start using SOAP, 37 37 00:01:14,940 --> 00:01:16,590 you need to make sure that you're thinking about it 38 38 00:01:16,590 --> 00:01:18,540 from a security perspective too. 39 39 00:01:18,540 --> 00:01:19,470 One of the biggest things 40 40 00:01:19,470 --> 00:01:22,020 is to always use it using the least privilege. 41 41 00:01:22,020 --> 00:01:23,880 This way when these services are communicating 42 42 00:01:23,880 --> 00:01:24,960 to each other using SOAP, 43 43 00:01:24,960 --> 00:01:26,580 they're doing that with the least privilege, 44 44 00:01:26,580 --> 00:01:28,890 and it prevents you from having privilege escalation 45 45 00:01:28,890 --> 00:01:30,030 and reduces the chance 46 46 00:01:30,030 --> 00:01:31,710 the people get into things they shouldn't. 47 47 00:01:31,710 --> 00:01:33,030 Additionally, you want to make sure 48 48 00:01:33,030 --> 00:01:36,420 your security framework is using a deny by default policy, 49 49 00:01:36,420 --> 00:01:38,790 and you want to provide the needed levels of access 50 50 00:01:38,790 --> 00:01:40,740 to data and other network resources 51 51 00:01:40,740 --> 00:01:42,240 that are needed by these services, 52 52 00:01:42,240 --> 00:01:44,310 but you want to do it in a secure mechanism. 53 53 00:01:44,310 --> 00:01:46,020 Now, when we start talking about SOAP, 54 54 00:01:46,020 --> 00:01:49,440 we want to make sure that we leverage Web Service Security, 55 55 00:01:49,440 --> 00:01:50,910 or WS-Security. 56 56 00:01:50,910 --> 00:01:53,250 These are extensions that are used to enforce integrity 57 57 00:01:53,250 --> 00:01:57,090 and confidentiality when you're communicating over SOAP. 58 58 00:01:57,090 --> 00:02:00,210 Now, web services using SOAP may be vulnerable 59 59 00:02:00,210 --> 00:02:02,010 to several different types of exploits, 60 60 00:02:02,010 --> 00:02:03,270 and that's what I want to focus on 61 61 00:02:03,270 --> 00:02:05,730 in the rest of our time together in this lesson. 62 62 00:02:05,730 --> 00:02:08,940 These include things like probing, coercive parsing, 63 63 00:02:08,940 --> 00:02:13,080 external references, malware, and SQL injection. 64 64 00:02:13,080 --> 00:02:15,420 And so we have to be aware of these different exploits 65 65 00:02:15,420 --> 00:02:18,360 so that we can then figure out how we can help prevent them. 66 66 00:02:18,360 --> 00:02:20,370 For example, if you're dealing with probing, 67 67 00:02:20,370 --> 00:02:21,720 this is a preliminary attack 68 68 00:02:21,720 --> 00:02:23,220 that's used to conduct reconnaissance 69 69 00:02:23,220 --> 00:02:25,860 or enumeration against a web service. 70 70 00:02:25,860 --> 00:02:27,480 So if somebody is using SOAP, 71 71 00:02:27,480 --> 00:02:29,640 and it's a way to communicate between services, 72 72 00:02:29,640 --> 00:02:31,740 that means somebody could also use SOAP 73 73 00:02:31,740 --> 00:02:33,480 to try to do reconnaissance 74 74 00:02:33,480 --> 00:02:35,790 or enumeration against your web service. 75 75 00:02:35,790 --> 00:02:37,530 They might send things against your API 76 76 00:02:37,530 --> 00:02:39,030 and see what the response is, 77 77 00:02:39,030 --> 00:02:41,160 and by doing that, they can start fingerprinting it 78 78 00:02:41,160 --> 00:02:43,920 and footprinting it and figuring out how it works. 79 79 00:02:43,920 --> 00:02:45,540 Now the second thing we have to be aware of 80 80 00:02:45,540 --> 00:02:46,980 is coercive parsing. 81 81 00:02:46,980 --> 00:02:49,080 Now, this is an attack that modifies requests 82 82 00:02:49,080 --> 00:02:51,660 to SOAP web services in order to cause the service 83 83 00:02:51,660 --> 00:02:54,750 to parse the XML-based requests in a harmful way. 84 84 00:02:54,750 --> 00:02:56,970 Remember, we said SOAP is used to communicate things 85 85 00:02:56,970 --> 00:02:58,710 between these different web services, 86 86 00:02:58,710 --> 00:03:00,960 and the format they use is XML-based. 87 87 00:03:00,960 --> 00:03:03,930 So if I can get you to parse the XML file 88 88 00:03:03,930 --> 00:03:05,700 and do things in a harmful way, 89 89 00:03:05,700 --> 00:03:07,230 I might be able to have a payload 90 90 00:03:07,230 --> 00:03:09,240 that's crafted inside of XML, 91 91 00:03:09,240 --> 00:03:10,710 and when you read it and parse it, 92 92 00:03:10,710 --> 00:03:12,240 that's going to take that payload 93 93 00:03:12,240 --> 00:03:14,220 and then trigger it on your system. 94 94 00:03:14,220 --> 00:03:16,050 That might cost some kind of an exploit to run 95 95 00:03:16,050 --> 00:03:17,640 or even a denial of service 96 96 00:03:17,640 --> 00:03:20,970 in which case I can then take down your servers. 97 97 00:03:20,970 --> 00:03:22,440 Now the third thing we have to think about 98 98 00:03:22,440 --> 00:03:24,120 is when you're dealing with these SOAP services, 99 99 00:03:24,120 --> 00:03:25,890 if you poorly configure them, 100 100 00:03:25,890 --> 00:03:27,840 they can actually make exploits available. 101 101 00:03:27,840 --> 00:03:30,390 And a lot of times, because you're dealing with XML, 102 102 00:03:30,390 --> 00:03:32,760 a lot of these things have external references. 103 103 00:03:32,760 --> 00:03:34,770 Now, when you're dealing with external references, 104 104 00:03:34,770 --> 00:03:35,760 this is where you're calling something 105 105 00:03:35,760 --> 00:03:37,530 like a third-party library in, 106 106 00:03:37,530 --> 00:03:40,860 or you're calling some third-party file on some other site. 107 107 00:03:40,860 --> 00:03:42,930 This is kind of like a remote file inclusion, 108 108 00:03:42,930 --> 00:03:43,860 and if you do this, 109 109 00:03:43,860 --> 00:03:45,990 it's going to allow this external reference to take over 110 110 00:03:45,990 --> 00:03:48,270 and bring that exploit into your server. 111 111 00:03:48,270 --> 00:03:50,100 Another thing we have to be worried about is malware 112 112 00:03:50,100 --> 00:03:53,430 because malware can be inserted into these XML messages 113 113 00:03:53,430 --> 00:03:55,680 and they could be used to compromise the service. 114 114 00:03:55,680 --> 00:03:57,480 So you want to keep that in mind as well 115 115 00:03:57,480 --> 00:03:59,640 and make sure that you're doing good input validation 116 116 00:03:59,640 --> 00:04:03,600 and good checks of these XML messages before you parse them. 117 117 00:04:03,600 --> 00:04:05,220 The final thing is we want to make sure 118 118 00:04:05,220 --> 00:04:08,310 we're avoiding SQL statements being sent over SOAP, 119 119 00:04:08,310 --> 00:04:09,840 especially when we're trying to do things, 120 120 00:04:09,840 --> 00:04:12,150 like a deletion, a modification, 121 121 00:04:12,150 --> 00:04:14,970 or access of an SQL database directly. 122 122 00:04:14,970 --> 00:04:15,810 If we can do this, 123 123 00:04:15,810 --> 00:04:18,180 this can help us avoid SQL injections 124 124 00:04:18,180 --> 00:04:19,740 because, again, SOAP by itself 125 125 00:04:19,740 --> 00:04:22,980 doesn't have the ability to filter out these SQL statements 126 126 00:04:22,980 --> 00:04:24,960 and so we want to make sure that as a best practice, 127 127 00:04:24,960 --> 00:04:28,560 we're not allowing SQL queries going directly over the web 128 128 00:04:28,560 --> 00:04:31,290 through the SOAP protocol into our SQL database. 129 129 00:04:31,290 --> 00:04:34,500 Instead, we should receive those, we should process those, 130 130 00:04:34,500 --> 00:04:37,293 and then if they're safe, push them into the database.