WebApp Sec mailing list archives

Re: SOAP Debugger - a simple, generic SOAP client


From: Chuck <chuck.lists () gmail com>
Date: Fri, 17 Jun 2005 14:04:42 -0400

   Thanks to everyone for the replies.  Good to know what else is out
there.  I've messed with SoapDebugger and the other free (as in beer I
believe) tool mentioned (WebServiceStudio,
http://www.gotdotnet.com/team/tools/web_svc/default.aspx) and I wanted
to send along my experiences.  They both
seem to handle simple SOAP requests okay (i.e. those that don't use
complexTypes defined in the WSDL), but don't work in more complex
situations.  For example, using the Google Web Service, they can
handle the SpellCheck, but not the GetCachedPage or GoogleSearch
methods.  Both had big problems with the Amazon AWSECommerceService
which uses a bunch of complexTypes.  Maybe the commercial tools can
handle complexTypes, but I'm just messing around trying to get
familiar with testing web services for now, so I'm most interested in
Open Source tools.

   I was able to patch SoapDebugger to work with Google's
GetCachedPage request (which was returning a byte array, I'll send the
patch along to Sverre), but not for the GoogleSearch function (which
returns a complexType defined in the WSDL).  The error I get is that
there is no deserializer registered to decode the response.  I thought
that the WSDL parser would handle creating that deserializer, but I
guess not.  Is anyone familiar with Apache Axis (the framework that
SOAPDebugger uses) enough to know if this is something that can be
automated (building the deserializer from the WSDL)?  I messed with it
for some time and came up with nothing.   Even if the response can't
be parsed, it would be nice to be able to display the raw XML of the
response, but I couldn't figure out how to get to that.  If anyone
knows Axis and it makes a difference, SOAPDebugger uses Axis version
1, not 2.  Maybe Axis2 has a better way to do the deserializing.

  The good news is that SOAPDebugger can easily use a proxy, you
simply pass it the options at runtime (such as java
-Dhttp.proxyHost=localhost -Dhttp.proxyPort=8008 SOAPDebugger
googleapi.wsdl).  The awesome things is that those options are not
used by SOAPDebugger, but by Axis, so this works with any client /
test harness that uses Axis (I tried it with Amazon's Java example and
it worked fine).  It may even work with other Java frameworks.

   Okay, that is all.  Have a good one, everybody.

Chuck


Current thread: