Everything You Need to Know About SOAP & How Pentesters Exploit Them?

SOAP (Simple Object Access Protocol) is the backbone of legacy API, with strict standards and high security. So Let’s roll deep into SOAP and what it is!

What is SOAP?

Soap is a protocol used for exchanging structured information between computers over a network. Explaining in Simple manner, Imagine you are sending an important letter. You must follow an exact format. Include everything in a strict template. Use truested courier to deliver it. The post office won’t accept is anything is out of order.

That’s how SOAP works! Think of SOAP as strict post office that follows fixed rules.

Key Characteristics of SOAP:

Protocol — SOAP is a protocol, not just a concept — it has strict standards.

Uses XML — All SOAP messages are written in XML (Extensible Markup Language).

Transport-agnostic — Can work over HTTP, SMTP, TCP, and more.

Strict rules — Follows a strict structure (envelope, header, body, fault).

Built-in error handling — Has a special part of the message to handle faults/errors.

How SOAP works in real life?

1. A client sends a SOAP request in XML.
2. The server receives the request and process it.
3. The server responds with another SOAP-formatted XML.
4. If something goes wrong, it sends a SOAP Fault message.

Why Big Companies Still Use SOAP?

Enterprise-level security: WS-Security (XML-based authentication & encryption).

Transaction safety: Ensures full delivery even in complex financial systems.

Strict validation: Makes data exchange predictable and controlled.

Service Contracts: SOAP uses WSDL (Web Services Description Language) which clearly defines what a service can do.

How SOAP is related to Certified API Pentesting?

In certified API pentesting (e.g., APIsec Certified, eWPT, CEH, OSWE, etc.), the job is to identify and exploit vulnerabilities in APIs — and SOAP is one of the major API technologies you must understand.

Most modern APIs use REST or GraphQL, but many critical systems (banks, insurance, government, healthcare, telecom) still rely heavily on SOAP APIs for their reliability and security features.

Why Pentesters Must Know SOAP:

1. SOAP is used in critical sectors — SOAP is common in banking, telecom, government, ERP, etc., which are high-value pentesting targets.
2. WSDL exposes full functionality — SOAP uses WSDL (Web Services Description Language), which can be abused for recon or automation.
3. Different attack surface than REST — Attacks like XML injection, XXE (XML External Entity attacks), WS-Security misconfigurations, and SOAPAction spoofing are unique to SOAP.

Common SOAP Vulnerabilities in Pentesting:

1. XML External Entity (XXE) Attacks: — SOAP relies heavily on XML. — Malicious XML payloads can extract server files or initiate SSRF (Server-Side Request Forgery).
2. WSDL Enumeration: — WSDLs describe all available functions, inputs, and outputs. — Attackers can enumerate the WSDL file to learn exact attack points.
3. SOAPAction Spoofing: — The SOAPAction HTTP header defines the operation being invoked. — Spoofing or manipulating it can cause misrouting or logic bypass.
4. Broken Authentication: — If WS-Security is misconfigured or optional, attackers can: — Omit tokens or credentials. — Use unsigned or expired messages. — Replay captured SOAP messages.
5. Improper Input Validation: — Just like in REST, SOAP endpoints may fail to sanitize: — Injected XML payloads. — SQLi in XML elements. — Command injection via data fields.

SOAP Pentesting Tools:

1. SoapUI:- The most popular GUI for sending, modifying, and automating SOAP requests.
2. Postman:- Can be configured to send SOAP requests.
3. BurpSuite:- Intercept, modify, and test SOAP endpoints.

In a Certified API Pentest, You Would:

1. Identify if the API is SOAP-based (look for XML format and WSDL).
2. Download and analyze the WSDL file to map available methods.
3. Test authentication (e.g., missing WS-Security).
4. Inject malicious XML payloads to test for XXE, XML bombs, etc.
5. Modify SOAPAction headers to test logic flaws.
6. Check rate limiting, authorization, replay protections.
7. Document all vulnerabilities, along with reproduction steps and risk rating.

Conclusion:

SOAP might be older than REST, but it’s still very relevant in real-world enterprise environments, which is why it’s included in certified API penetration testing programs.

If you aim to become a professional API pentester or pass advanced certs (like APIsec Certified, eWPT, or OSWE), you must learn how to attack SOAP-based APIs just as fluently as REST or GraphQL.