Hello,
I am a somewhat newbie pen-tester.  I have been tasked by my company to pen test one of our web sites (Silverlight, ASP.Net).
The WSDL is not published.

How could I go about creating a local client to try to consume some of the web services?

Any articles, books, tutorials or pointers would be greatly appreciated.

Thanks.

Chris

Sorry I wasn't more clear
What I would like to be able to do, is to see if I could create a local client (say in c#) that would call the remote web service to see if I can return information from the service without proper authorization.

So within the company application this service would require authorization and authentication -- I want to see if it is possible to access the web service without the proper credentials and determine if any of th company data could be at risk

I hope that makes more sense.

Thanks.

Hey,

I have wrote several web services myself for a "Big Bank" and the best tool to use is soapUI http://www.soapui.org/. Very easy to use.

What do you mean by the WSDL is not published? It should always be... That's one of the fundamental piece of SOAP. Do you mean there is no "publicity" about them or they aren't available at all? If they aren't available, then soapUI isn't the best tool...