Exploiting WSDLs with Wsdler

Web Services Description Language (WSDL) is an XML-based language that's used to describe the functionality offered by web services. Often, while doing a pentest project, we may find a WSDL file out in the open, unauthenticated. In the following recipe, we will see how we can take advantage of WSDL.

How to do it...

We have to intercept the request of WSDL in Burp. Follow these steps to do so:

1. Right-click the request and select Parse WSDL:

2. Switch to the Wsdler tab and you will see all the service calls. We can review the complete request by clicking on it:

3. To be able to play around with it, we need to send it to the repeater:

4. Right-click and select Send to Repeater:

5. Putting a single...