Exploiting WSDLs with Wsdler

Web Services Description Language (WSDL) is an XML-based language used to describe the functionality offered by a web service. Often while executing a pentest project, we may find a WSDL file out in the open, unauthenticated. In this recipe, we will look at how we can benefit from WSDL.

How to do it...

We intercept the request of WSDL in Burp:

1. Right-click on the request and select Parse WSDL:

2. Switch to the Wsdler tab, and we will see all the service calls. We can see the complete request by clicking on any one of them:

3. To be able to play around with it, we will need to send it to the Repeater:

4. We right-click and select Send to Repeater:

5. In our case, we can see that putting a single...