1. Documentation
2. The ZAP Desktop User Guide
3. Add-ons
4. SOAP Support

SOAP Support

This add-on imports and scans WSDL files containing SOAP endpoints.

It also supports the Automation Framework.

Importing

The add-on will automatically detect any SOAP definitions and spider them as long as they are in scope.

A menu item is added to the Import menu:

• Import a WSDL File

Operations to import a WSDL file from the local filesystem or from a URL are also available via the API.

NOTE: As of version 6 of this add-on, only encoded URLs are supported.

Form Handler Add-on Support

The SOAP add-on supports overriding default parameter values based on field names via the Form Handler add-on. For example,

Scanning

The scan rules added by this add-on are:

• Action Spoofing : http://www.ws-attacks.org/index.php/SOAPAction_Spoofing
• XML Injection : http://www.ws-attacks.org/index.php/XML_Injection

Statistics

This add-on maintains the following statistics:

• soap.urls.added: The total number of URLs (or SOAP Actions) added from imported WSDL files.