Click here to Skip to main content
15,867,686 members
Articles / All Topics
Article

Intercepting Calls in Web Services (Worker Process)

Rate me:
Please Sign up or sign in to vote.
5.00/5 (3 votes)
7 Nov 2011CPOL2 min read 17.6K   12   2
How to intercept Web Service calls directly in the worker process.

Introduction

This is not a tutorial about Web Services and their usage. The usage of this technology is well known across the software industry.

The purpose of this article is to show a method for “how to intercept Web Service calls and show in screen”. We will work directly on the Worker process. Unfortunately, with sniffers, we can’t get traffic from localhost.

OK, let’s start:

Suppose you have an application which is calling a WebService.

  1. Open Windows Debugger: windbg.exe process.
  2. Press F6 and attach the w3wp.exe process.
  3. Once we get the process attached, execute the command (.loadby sos mscorwks in the case of .NET Framework < 4.0): .loadby sos mscoreei.
  4. After deep research, I found an interesting function which could be useful: System.Web.HttpRequest.GetEntireRawContent.
  5. Let’s try to see where this function is JITted:
  6. !name2ee * System.Web.HttpRequest.GetEntireRawContent

    Image 1

  7. The JITted address is 5241cfd0, so let’s put a breakpoint right there: bp 5241cfd0.
  8. Use your application and it will get frozen because the breakpoint was launched.
  9. On investigation, this function runs and returns the System.Web.HttpRawUploadedContent class. To run this method until the end, let’s put the pt command.
  10. Image 2

  11. By simple examination, we can see that this returns on the @eax register all the variables with the class HttpRawUploaded. Let us see the _data field.
  12. Image 3

  13. Good, we have the entire content in byte[] of the WebService call. How can we dump in screen every time this function is called? .printf "%ma",poi(eax+4)+8, where 4 is the offset to get the data in this class, eax is the return address of this method, and 8 is the address of the first char in the Web Service. %ma means ANSI characters.
  14. Image 4

  15. Let’s delete the first breakpoint and put a new one at the end of this function: bc *.
  16. Let’s put: Bp eip “.printf \"\\n%ma\",poi(eax+4)+8;gc”.
  17. We now have all the calls of the Web Service for monitoring.

Image 5

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Tester / Quality Assurance
Bolivia Bolivia
Quality Assurance

Comments and Discussions

 
SuggestionFiddler? Pin
vipera668-Nov-11 8:59
vipera668-Nov-11 8:59 
GeneralRe: Fiddler? Pin
Rene Pally8-Nov-11 9:54
Rene Pally8-Nov-11 9:54 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.