Soapbx Oswe 〈Mobile〉

OffSec provides the "WEB-300" course (now often referred to as PEN-300 for advanced web). Do not skip the exercises. Pay special attention to the chapters on SOAP Attacks and Advanced Deserialization.

The OSWE certification (offered by OffSec) focuses on white-box web application exploitation. This means students must analyze source code to find vulnerabilities and then write exploitation scripts to chain them together for Remote Code Execution (RCE).

SOAPbx was created specifically to simulate this exam experience. Key features include: SOAP action and content-type manipulation

The modern security lifecycle is plagued by the "Exploitation Gap." Automated scanners and manual assessments excel at finding vulnerabilities—such as deserialization flaws, complex SQLi variants, and logic-based access control issues—but fail to answer the most critical question: Can an attacker actually weaponize this to steal data or disrupt operations?

Without proof of exploitation, security teams struggle to prioritize remediation efforts. Development teams push back on theoretical vulnerabilities, and executive leadership remains under-invested in critical infrastructure upgrades.

Soapbx OSWE was engineered to close this gap. Moving beyond the capabilities of standard scanning engines, OSWE functions as a highly targeted exploitation framework that safely demonstrates the full blast radius of a vulnerability within a controlled environment. XML External Entity (XXE)

<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <getUserInfo>
      <username>&xxe;</username>
    </getUserInfo>
  </soap:Body>
</soap:Envelope>

<soap:Body>
  <login>
    <user>' or '1'='1</user>
    <pass>irrelevant</pass>
  </login>
</soap:Body>

To pass the OSWE and specifically the SoapBX node, you cannot rely on automated scanners. You need a disciplined methodology.