Which attack duplicates the body of a SOAP message during TLS processing and sends it to the server as a legitimate user?

Which attack duplicates the body of a SOAP message during TLS processing and sends it to the server as a legitimate user?

• A. Replay Attack
• B. Wrapping Attack
• C. Man-in-the-Middle
• D. SQL Injection

Answer: (B)

The key idea is a SOAP/XML security flaw where the signed part of a SOAP message is wrapped in such a way that the server ends up processing a payload that the attacker controls, while the signature still appears valid. In a SOAP wrapping attack, an attacker takes a legitimately signed SOAP request and manipulates the envelope so that the body the application actually uses is replaced with a duplicated or attacker-chosen body, but the part that was signed remains intact in a different position. Because the signature validates the original body, the server trusts the message, yet the application acts on the attacker’s content as if it came from the legitimate user. TLS only protects the transport; it doesn’t prevent this kind of message-structure manipulation at the application layer. This is why it fits best: it specifically describes duplicating the body during processing and delivering it to the server as if it were a legitimate, signed request. The other attacks don’t capture this mechanism—replay attacks simply resend a message, and man-in-the-middle, SQL injection, or general content tampering describe different threat patterns not focused on how the SOAP body is swapped within the signed envelope.

The key idea is a SOAP/XML security flaw where the signed part of a SOAP message is wrapped in such a way that the server ends up processing a payload that the attacker controls, while the signature still appears valid. In a SOAP wrapping attack, an attacker takes a legitimately signed SOAP request and manipulates the envelope so that the body the application actually uses is replaced with a duplicated or attacker-chosen body, but the part that was signed remains intact in a different position. Because the signature validates the original body, the server trusts the message, yet the application acts on the attacker’s content as if it came from the legitimate user. TLS only protects the transport; it doesn’t prevent this kind of message-structure manipulation at the application layer.

This is why it fits best: it specifically describes duplicating the body during processing and delivering it to the server as if it were a legitimate, signed request. The other attacks don’t capture this mechanism—replay attacks simply resend a message, and man-in-the-middle, SQL injection, or general content tampering describe different threat patterns not focused on how the SOAP body is swapped within the signed envelope.