Web Service Security UsernameToken Primer

re: Web Service Security UsernameToken Primer

Avkash — Tue, 03 Feb 2009 05:25:34 GMT

hi!!

Actually i m working for development of "web services security assessment tool " and i need some help to understand "how one can perform bufferoverflow attack on any web service and how we can stop them???"

i kindly request u 2 provide any help u can....

re: Web Service Security UsernameToken Primer

Jason Hogg — Wed, 04 Feb 2009 07:13:23 GMT

Hi Avkash, I am not sure if you would necessarily be performing a buffer overflow attack on a service, rather then platform on which the service is running. In terms of how you prevent buffer overflow attacks assuming you don't own the platform, a good place to start would be to specify max message sizes on your incoming messages. Not entirely sure if I understood you - so hopefully this helps.

re: Web Service Security UsernameToken Primer

Ross Mallett — Thu, 09 Jul 2009 04:16:28 GMT

"In addition to verifying the hash, WSE also signs the message with HMAC-SHA1 using 16 bytes of key data from the hash keys."

Could you elaborate on this? I'm trying to validate the HMAC-SHA1 SignatureValue from a WSE3 client and I cannot derive the same SignatureValue.