Test 4) Insufficient Authentication

Insufficient Authentication Test

Vulnerability Type Dynamic

Test Web Service URI http://[yourhostName]/XXE.asmx?WSDL

http://[yourhostName]/Authentication.asmx?WSDL|wsuser|Wspass123

Vulnerable Code Block Each unauthenticated method

Attack Payload Methods are called with default parameter values.

Indications of Vulnerability

Web server returned: Http status code is 200 (i.e. OK - The request has succeeded).

Http status code is not equals to 401 (i.e. Unauthenticated/Authentication is required).