Stella, a professional hacker, performs an attack on web services by exploiting a vulnerability that provides additional routing information in the SOAP header to support asynchronous communication…

Question

Options

• AXML injection
• BWS-Address spoofing
• CSOAPAction spoofing
• DWeb services parsing attacks

• A
  5% (2)
• B
  70% (30)
• C
  16% (7)
• D
  9% (4)

Explanation

WS-Address Spoofing Explained

Option B is correct because WS-Addressing is a SOAP extension that embeds routing information (such as endpoint references and message IDs) directly in the SOAP header to enable asynchronous communication across different TCP connections - the exact scenario described. Stella exploits this mechanism to spoof routing headers, redirecting web service messages to malicious endpoints.

Why the distractors are wrong:

• A (XML Injection): Involves inserting malicious XML content into input fields to manipulate application logic - it doesn't target SOAP header routing information.
• C (SOAPAction Spoofing): Involves manipulating the HTTP SOAPAction header to invoke unintended web service operations, not exploiting asynchronous routing headers.
• D (Web Services Parsing Attacks): Target XML/SOAP parser vulnerabilities (e.g., oversized payloads) to crash services - unrelated to routing manipulation.

Memory Tip: Think WS-Address = "Where to send it" - if an attacker is faking where a message should go using header-based routing across multiple connections, that's WS-Address Spoofing. The keywords "routing information," "SOAP header," and "different TCP connections" are your dead giveaways on the exam.

No community discussion yet for this question.