Cracking The Foundation: Attacking Wcf Web Services

No ratings

Presented at ShmooCon 2011 by

Brian Holyfield made hacking WCF Web Services look easy. During his talk about HTTP/S proxies and MC-NBFS, Holyfield pointed out that there was limited support for MC-NBFS/MSBin1 in most common proxy tools. He suggested Richard Berg’s Fiddler Binary XML Inspector for reading binary XML messages. When talking about MetaData over SSL, Holyfield reminded the audience that the default Visual Studio template does not provide for an “s” at the end of http. During the remainder of the presentation, Holyfield demonstrated leveraging MetaData for manual testing using WcfTestClient, which automatically parses WSDL or MEX. WcfTestClient ships with Visual Studio 2008+. In addition, Holyfield discussed WCF Storm, which supports most WCF bindings.