# Erlik | Vulnerable Soap Service

**URL:** <https://onehack.st/t/erlik-vulnerable-soap-service/223376>\
**Category:** Tools & Scripts\
**Tags:** tools, programming, hacking\
**Created:** [September 2, 2022, 9:01pm UTC](https://onehack.st/t/erlik-vulnerable-soap-service/223376 "2022-09-02T21:01:41Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [September 2, 2022, 9:01pm UTC](https://onehack.st/t/erlik-vulnerable-soap-service/223376/1 "2022-09-02T21:01:41Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/a/b/ab1188bbd15b3b5e429160a0a4e6ec01eed2ca8d.jpeg)

# Vulnerable-Soap-Service

Erlik - Vulnerable Soap Service

Tested - Kali 2022.1

## Description

It is a vulnerable SOAP web service. It is a lab environment created for people who want to improve themselves in the field of web penetration testing.

## Features

It contains the following vulnerabilities.

-LFI

-SQL Injection

-Informaion Disclosure

-Command Inejction

-Brute Force

-Deserialization

## Installation

git clone [https://github.com/anil-yelken/Vulnerable-Soap-Service](https://github.com/anil-yelken/Vulnerable-Soap-Service)

cd Vulnerable-Soap-Service

sudo pip3 install requirements.txt

## Usage

sudo python3 vulnerable\_soap.py

[![](https://github.com/anil-yelken/Vulnerable-Soap-Service/raw/main/server.jpg)](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/server.jpg)

## Exploiting Vulnerabilities

### LFI

Code:[https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/lfi.py](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/lfi.py)

[![](https://github.com/anil-yelken/Vulnerable-Soap-Service/raw/main/lfi.jpg)](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/lfi.jpg)

### SQL Injection

Code:[https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/sqli.py](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/sqli.py)

[![](https://github.com/anil-yelken/Vulnerable-Soap-Service/raw/main/sqli.jpg)](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/sqli.jpg)

### Informaion Disclosure

Code:[https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/get\_logs\_information\_disclosure.py](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/get_logs_information_disclosure.py)

[![](https://github.com/anil-yelken/Vulnerable-Soap-Service/raw/main/get_logs_information_disclosure.jpg)](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/get_logs_information_disclosure.jpg)

Code:[https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/get\_data\_information\_disclosure.py](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/get_data_information_disclosure.py)

[![](https://github.com/anil-yelken/Vulnerable-Soap-Service/raw/main/get_admin_email_information_disclosure.jpg)](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/get_admin_email_information_disclosure.jpg)

### Command Injection

Code:[https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/commandi.py](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/commandi.py)

[![](https://github.com/anil-yelken/Vulnerable-Soap-Service/raw/main/commandi.jpg)](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/commandi.jpg)

### Brute Force

Code:[https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/brute.py](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/brute.py)

[![](https://github.com/anil-yelken/Vulnerable-Soap-Service/raw/main/brute_force.jpg)](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/brute_force.jpg)

### Deserialization

Code:

[https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/deserialization\_socket.py](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/deserialization_socket.py)

[https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/deserialization\_requests.py](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/deserialization_requests.py)

[![](https://github.com/anil-yelken/Vulnerable-Soap-Service/raw/main/deserialization.jpg)](https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/deserialization.jpg)

## GitHub:

[https://github.com/anil-yelken/Vulnerable-Soap-Service](https://github.com/anil-yelken/Vulnerable-Soap-Service)