Windows Communication Foundation Penetration Testing Methodology

Windows Communication Foundation (WCF) is a communication framework for building connected, service-oriented applications, initially released by Microsoft as part of.NET Framework, but now open source. The WCF message-based communication is a very popular solution used for sending asynchronous messages from one service endpoint to another. Because WCF provides many functionalities it has a large-consuming development model and often the security measures implemented in applications are not proper. In this study we propose a methodology for offensive security analysis of an WCF endpoint or service, from red team perspective. A step by step approach, empirical information, and detailed analysis report of WCF vulnerabilities are presented. We conclude by proposing recommendations for mitigating attacks and securing endpoints.