Search code examples
asp.netweb-servicessecurityasmx

Can you find my .asmx?

A web server running a ASP.NET web service. To use the web service you must go to http://example.com/UtilServerComp/getCashNow7899.asmx

Adding ?WSDL is possible to get service description.

I assume that without knowledge of the URL and exact name of the .asmx this page will not be found or am I wrong? Crawling the web site will not work since you have to guess the name getCashNow7899 as well as UtilServerComp and that is not very likely...

Solution

  • It is rather unlikely that someone will find out your service without knowing the name. Also remember that you can switch off the documentation protocol:

    <webServices>
   <protocols>       
       <remove name="Documentation"/>
   </protocols>   
</webServices>

    However, if you deploy any application that uses the service, the client could use an http debugger to sniff the traffic and learn the exact address and the exposed interface.