Vulnerability Development: Re: xml over https

[Mads Rasmussen <mads () opencs com br>]

Burke, Charles wrote:

> This web services was not using WS Security was it?
> I am assuming the xml encryption was custom or was it provided by WSE?
>  
No WS security, not even webservices ;-)
Just simple encryption (a .dll doing 3des encryption) of specific XML 
fields in an XML file, transported between the client and the server via 
https
No encryption mode, that is ECB basically.

As I said, I did a small application calling their routine to decrypt 
the fields without specifying the key.
Mads