diff --git a/README.md b/README.md index 6fa2bb6..b9529b3 100644 --- a/README.md +++ b/README.md @@ -19,10 +19,12 @@ In the current version, WS-Attacker supports the following attacks: The first option to obtain a WS-Attacker jar file is from the sourceforge website: https://sourceforge.net/projects/ws-attacker/files/ The second option is to build it directly from the Github sources. For this purpose, you need: -- Java 7 or higher +- Java 7 or 8 - maven - git +Hint: With Java 9+ it will not work at runtime due to removed class loader URLClassLoader() + You procede as follows. You first need to clone WS-Attacker sources (you can of course also download a ZIP file): ```bash @@ -36,16 +38,29 @@ $ cd WS-Attacker $ mvn clean package -DskipTests ``` -Afterwards, you are able to go to the runnable directory and execute WS-Attacker: +Afterwards, you are able to go to the runnable directory and execute WS-Attacker (with Java 7 or 8): ```bash $ cd runnable $ java -jar WS-Attacker-1.9-SNAPSHOT.jar ``` +Hint: With Java 9+ the plugins are not loaded anymore due to removed class loader URLClassLoader()
+With Java 11+ it would not start due to removed Java EE modules (JAX-WS, JAXB, ...) ## WS-Attacker Usage +If WSDL web services discovery is not possible (e.g. due to hardening) but you have the WSDL file locally (and the corresponding XSD file), you can import them as follows.
+On Windows copy all to `C:/Users/User/workspace/` + +Now in the tab "WSDL Loader" enter `file:///C:/Users/User/workspace/Service.wsdl` and press the Load button + +Hint: Check the WSDL file for an XSD import if they are relative or directly loaded.
+Change:
+`` +into locally import, relative to the WSDL location:
+`` + You can find the latest documentation on XML Signature Wrapping and DoS attacks here: https://sourceforge.net/projects/ws-attacker/files/WS-Attacker%201.3/Documentation-v1.3.pdf/download