Chapter 8: Attacking XML Web Services

Overview

As we noted in Chapter 1, XML web services remain the latest rage in the computing world, currently enjoying backing and support from Internet technology juggernauts including Microsoft, IBM, and Sun. Web services theoretically will form the "glue" that will allow disparate web applications to communicate with each other effortlessly, and with minimal human intervention. As Microsoft puts it, web services provide "a loosely- coupled , language-neutral, platform-independent way of linking applications within organizations, across enterprises , and across the Internet."

The computing world has seen many previous attempts to design the perfect interapplication communications protocol, and anyone who's been around long enough to see RPC, DCOM, CORBA, and the like will know that the track record for such endeavors is quite spotty security-wise (although this is not necessarily due to the protocols themselves , but rather to the ease with which they make application interfaces available).

Do web services harbinger a turn towards better application security on the Internet, or are we merely at the cusp of yet another revolution in web hacking as the technology matures and begins to proliferate across the network? This chapter will attempt to answer this question by first discussing what a web service actually is, and then how it might be attacked .