and here I am, pentesting a web application with its web services exposed. The .asmx service is available and the wsdl is gladly provided.

However, the wsdl and all are available from within an authenticated session. The problem is, how to load the wsdl file (and create an authenticated session with username & password) on a Web Services sec tool such as WS-Digger.

The same problem is applicable for soapUI. The tool cannot access the WSDL document as application authentication is required. I did download the WSDL document and uploaded it to soapUI but when a test case is to be run, it fails miserably (even though I do provide the username and password in the Request parameters)

So, my question would be on how you assess Web Services that are protected behind an authenticated session and how it would be possible to provide WSDigger (or soapUI) with the necessary credentials in order to be able and fetch the supported methods.

Thanks!

~/h0rdakk