from SOAPpy import WSDL
import re

# The URL to the WSDL to test.
url = 'http://www.xmethods.net/sd/2001/TemperatureService.wsdl'

BadStrings = [ 
'Baseline',
'%x%x%x',
'<script>alert("XSS");</script>',
'A'*100]

BadInts = [2, 0, -1, 65536, 18446744073709551616, -65536, -18446744073709551616]

BadFloats = [2.0, 0.0, -1.0, 65536.65536, 
18446744073709551616.18446744073709551616, -65536.65536, 
-18446744073709551616.18446744073709551616]

# just use the path to the wsdl of your choice
server = WSDL.Proxy(url)

server.soapproxy.config.dumpSOAPOut = 1 # Show the SOAP request
server.soapproxy.config.dumpSOAPIn = 1  # Show the reply from server

# A recursive function to call the procedure with each test parameter set.
def makeSOAPCall(fcn, callParams, paramList):
  try: 
    if(len(callParams) == 0):       # Is this the last parameter?
      fcn(*paramList)               # Call the function with the test params.
      return
  except:
    print "\n", paramList , " caused an error.\n"
    return

  testList = callParams.pop(0)       # Get test values. Start at front of list.

  for testString in testList :
    paramList.append(testString)    # Add value to the list
    makeSOAPCall(fcn, callParams, paramList)
    paramList.pop()                 # Remove value from the list 

  #callParams.insert(0, testList)      # Test every possible parameter combination
  callParams.insert(0, [testList[0]])  # Use baselines for other parameters

print 'Available methods:'
for methodName in server.methods.keys() :
  print "method: ", methodName
  ci = server.methods[methodName]

  callParams = []
  for param in ci.inparams :
    print "name: ", param.name.ljust(20) , " type: ", param.type

    # The types we search for and know about.
    typeIsString = re.compile('string')
    typeIsInt    = re.compile('int')
    typeIsFloat  = re.compile('float')

    # param.type is a tuple, we want the 2nd value
    type = param.type[1]
    if typeIsString.search(type) :
      callParams.append(BadStrings)   
    elif typeIsInt.search(type) : 
      callParams.append(BadInts)
    elif typeIsFloat.search(type) : 
      callParams.append(BadFloats)
    else: # If we find an unkown type we break so that it may be dealt with
      print 'Unkown type: ', type
      break

  print
 
  # Get an instance of the method so we can call it.
  fcn = getattr(server, methodName) 

  makeSOAPCall(fcn, callParams, []) # Call create the test strings and make requests