Contract discovery
// tool: discover_soapCommon WSDL and ASMX mounts are probed, plus any endpoint the scan has already classified as SOAP. The contract is then parsed, not guessed — operations, their parameters, the SOAPAction header and the real service URL — which is what makes every later check per-operation instead of per-URL. If no WSDL parses, nothing is recorded.
// WHAT THE PARSE YIELDS
// WSDL EXPOSURE low–medium
A publicly readable WSDL enumerates the entire operation surface — including the internal operations that were never meant to be callable from outside. Recorded with the operation list attached, so the conversation with your integration team is about a concrete inventory rather than a principle.
XXE — in-band and blind
// tool: scan_soapAn XML parser that resolves external entities will read local files and make outbound requests on an attacker's behalf. Both variants are tested, and both are confirmed by evidence rather than by the parser's configuration.
// IN-BAND XXE high — the file comes back
// BLIND XXE high
When nothing reflects, the external entity is pointed at an out-of-band canary. No callback, no finding — and with no collaborator configured the probe is never sent.
// WS-ADDRESSING REPLYTO SSRF high
A header designed to make the service call you back is an SSRF primitive by construction. Same rule: confirmed out-of-band or not recorded at all.
Injection per operation
// tool: fuzz_soapPayloads go into the parameters the WSDL says exist, inside a well-formed envelope with the right SOAPAction — the only way these services respond at all. The confirmation oracles are the HTTP detectors' own, so a SOAP finding is held to exactly the same evidence bar as a REST one.
SQL INJECTION
Error-based: the database engine names itself in the fault. These services are usually one thin layer over the database of record, which is what makes it serious.
XPATH INJECTION
A boolean row differential — a true condition returns records, a false one doesn't. XML back ends query with XPath, and it injects exactly like SQL.
COMMAND INJECTION
A cross-platform arithmetic oracle plus a uid marker: the finding is the evaluated result, never the echoed payload.
// VERBOSE SOAP FAULTS medium
SOAP stacks are famously talkative when they break. A fault carrying a full stack trace hands over namespaces, internal class names, file paths and the back-end engine — the map an attacker uses to aim everything else. Recorded when the trace is really there; a fault with a generic message is correct behaviour and stays silent.
What gets recorded
// XXE · injection · SSRF · disclosure| Finding | How NewScan confirms it | Severity |
|---|---|---|
| Command injection | An arithmetic oracle evaluates, or a uid marker appears in the response. | critical |
| XXE (in-band) | Local file content read by an external entity is reflected back. | high |
| XXE (blind) / ReplyTo SSRF | The service reaches the out-of-band collaborator canary. | high |
| SQL / XPath injection | An engine-named error, or a boolean row differential across two probes. | high |
| Verbose SOAP fault | A stack trace leaking internals is returned in the fault body. | medium |
| WSDL exposure | A WSDL parses anonymously, enumerating the full operation surface. | low–medium |
How it's recorded
// audit-ready evidenceCATEGORY
XXE maps to CWE-611, injection to OWASP API8, ReplyTo SSRF to API7 — the controls an assessor is already asking about for these systems.
SEVERITY
One calibrated severity per finding that translates into each framework's risk rating and remediation SLA — no inflated numbers.
EVIDENCE
The full envelope sent, the operation and parameter used, and the fault or response that confirmed it — replayable by an assessor.
Point it at the system you can't replace.
NewScan is free and self-hosted — bring your own key. WSDL discovery, in-band XXE, the injection sweep and fault disclosure all run in the deterministic floor with no model or provider key; the blind XXE and ReplyTo SSRF confirmations need an OOB collaborator, which you can self-host.