Instructor: SOAP, or Simple Object Access Protocol. 2 2
In this lesson, we're going to talk about SOAP 3 3
and not the kind that you wash your hands with. 4 4
Instead, we're going to talk about the thing 5 5
that allows service-oriented architectures 6 6
to provide services with access from different sources. 7 7
Now, when you take all these different services 8 8
and you try to put them all together 9 9
and have that loose coupling 10 10
so that they can actually operate 11 11
and pass things back and forth, 12 12
they need a way to communicate. 13 13
Now, this is really important 14 14
because when people are building 15 15
all of these loosely coupled services, 16 16
they can write them in all sorts of different languages. 17 17
You might write yours in Java, I might write mine in Python. 18 18
Somebody else might use JavaScript, 19 19
somebody else might use Perl or Ruby. 20 20
And if we want them all to talk to each other, 21 21
we need a common way to do that. 22 22
Well, that is what SOAP is really about. 23 23
SOAP is the Simple Object Access Protocol, 24 24
and it provides an XML-based web service protocol 25 25
that's used to exchange these messages. 26 26
SOAP is going to provide a structure 27 27
for transmitting and receiving information 28 28
that's used in these web applications 29 29
to a variety of device types 30 30
using an application programming interface, known as an API. 31 31
Now, when we use SOAP, 32 32
it's going to help us to support the authentication, 33 33
the transport security, the asynchronous messaging, 34 34
and built-in error handling. 35 35
So it gives us a lot of good benefits. 36 36
Now, when you start using SOAP, 37 37
you need to make sure that you're thinking about it 38 38
from a security perspective too. 39 39
One of the biggest things 40 40
is to always use it using the least privilege. 41 41
This way when these services are communicating 42 42
to each other using SOAP, 43 43
they're doing that with the least privilege, 44 44
and it prevents you from having privilege escalation 45 45
and reduces the chance 46 46
the people get into things they shouldn't. 47 47
Additionally, you want to make sure 48 48
your security framework is using a deny by default policy, 49 49
and you want to provide the needed levels of access 50 50
to data and other network resources 51 51
that are needed by these services, 52 52
but you want to do it in a secure mechanism. 53 53
Now, when we start talking about SOAP, 54 54
we want to make sure that we leverage Web Service Security, 55 55
or WS-Security. 56 56
These are extensions that are used to enforce integrity 57 57
and confidentiality when you're communicating over SOAP. 58 58
Now, web services using SOAP may be vulnerable 59 59
to several different types of exploits, 60 60
and that's what I want to focus on 61 61
in the rest of our time together in this lesson. 62 62
These include things like probing, coercive parsing, 63 63
external references, malware, and SQL injection. 64 64
And so we have to be aware of these different exploits 65 65
so that we can then figure out how we can help prevent them. 66 66
For example, if you're dealing with probing, 67 67
this is a preliminary attack 68 68
that's used to conduct reconnaissance 69 69
or enumeration against a web service. 70 70
So if somebody is using SOAP, 71 71
and it's a way to communicate between services, 72 72
that means somebody could also use SOAP 73 73
to try to do reconnaissance 74 74
or enumeration against your web service. 75 75
They might send things against your API 76 76
and see what the response is, 77 77
and by doing that, they can start fingerprinting it 78 78
and footprinting it and figuring out how it works. 79 79
Now the second thing we have to be aware of 80 80
is coercive parsing. 81 81
Now, this is an attack that modifies requests 82 82
to SOAP web services in order to cause the service 83 83
to parse the XML-based requests in a harmful way. 84 84
Remember, we said SOAP is used to communicate things 85 85
between these different web services, 86 86
and the format they use is XML-based. 87 87
So if I can get you to parse the XML file 88 88
and do things in a harmful way, 89 89
I might be able to have a payload 90 90
that's crafted inside of XML, 91 91
and when you read it and parse it, 92 92
that's going to take that payload 93 93
and then trigger it on your system. 94 94
That might cost some kind of an exploit to run 95 95
or even a denial of service 96 96
in which case I can then take down your servers. 97 97
Now the third thing we have to think about 98 98
is when you're dealing with these SOAP services, 99 99
if you poorly configure them, 100 100
they can actually make exploits available. 101 101
And a lot of times, because you're dealing with XML, 102 102
a lot of these things have external references. 103 103
Now, when you're dealing with external references, 104 104
this is where you're calling something 105 105
like a third-party library in, 106 106
or you're calling some third-party file on some other site. 107 107
This is kind of like a remote file inclusion, 108 108
and if you do this, 109 109
it's going to allow this external reference to take over 110 110
and bring that exploit into your server. 111 111
Another thing we have to be worried about is malware 112 112
because malware can be inserted into these XML messages 113 113
and they could be used to compromise the service. 114 114
So you want to keep that in mind as well 115 115
and make sure that you're doing good input validation 116 116
and good checks of these XML messages before you parse them. 117 117
The final thing is we want to make sure 118 118
we're avoiding SQL statements being sent over SOAP, 119 119
especially when we're trying to do things, 120 120
like a deletion, a modification, 121 121
or access of an SQL database directly. 122 122
If we can do this, 123 123
this can help us avoid SQL injections 124 124
because, again, SOAP by itself 125 125
doesn't have the ability to filter out these SQL statements 126 126
and so we want to make sure that as a best practice, 127 127
we're not allowing SQL queries going directly over the web 128 128
through the SOAP protocol into our SQL database. 129 129
Instead, we should receive those, we should process those, 130 130
and then if they're safe, push them into the database.