CODEWITHSUNDEEP
asp.netweb-servicessecurityasmx
user1298720
user1298720

Reputation: 13

Can you find my .asmx?

A web server running a ASP.NET web service. To use the web service you must go to http://example.com/UtilServerComp/getCashNow7899.asmx

Adding ?WSDL is possible to get service description.

I assume that without knowledge of the URL and exact name of the .asmx this page will not be found or am I wrong? Crawling the web site will not work since you have to guess the name getCashNow7899 as well as UtilServerComp and that is not very likely...

Upvotes: 0

Views: 217

Answers (2)

Jordan
Jordan

Reputation: 2758

Why it's a bad idea to rely simply on having a service hidden.

Upvotes: 0

Wiktor Zychla
Wiktor Zychla

Reputation: 48314

It is rather unlikely that someone will find out your service without knowing the name. Also remember that you can switch off the documentation protocol:

<webServices>
   <protocols>       
       <remove name="Documentation"/>
   </protocols>   
</webServices>

However, if you deploy any application that uses the service, the client could use an http debugger to sniff the traffic and learn the exact address and the exposed interface.

Upvotes: 3

Related Questions