SOAP WSDL to Actions Generator

Paste raw WSDL XML — get SOAP envelopes and curl commands for every operation.

How it works

This tool parses a WSDL (Web Services Description Language) document and generates a complete, ready-to-send SOAP envelope and curl command for each operation defined in the service — saving you from writing boilerplate XML by hand during a CTF or pentest engagement.

1. Get the WSDL: append ?wsdl or ?WSDL to the service URL, or find it in source. Save the full XML.
2. Paste the WSDL: paste the raw XML into the textarea and click Generate Actions.
3. Get your envelopes: each SOAP operation gets its own envelope with placeholder parameter values, plus a curl command with the correct endpoint and SOAPAction header.
4. Send the request: copy the curl command, swap the placeholder values for real input, and fire it against the target.

What is WSDL?

WSDL is an XML-based interface description language for SOAP web services. It defines the available operations, their input/output message types and parameter names, the data types (via XML Schema), the binding (how SOAP maps to HTTP), and the endpoint URL. SOAP services expose WSDL publicly so clients can generate stubs — and so pentesters can discover the full attack surface.

wsdl:operation

Defines an available action. The name maps directly to the SOAP body element and often to the SOAPAction header value.

wsdl:message

Describes the input or output of an operation as a set of typed parts (parameters).

wsdl:types

Contains the XML Schema (XSD) definitions for all message types, including parameter names, types and cardinality.

soap:address location

The HTTP endpoint URL where SOAP requests must be sent, extracted and used directly in the curl command.

FAQ

Does this send requests to the target service?

No. Everything happens server-side in PHP. The tool only parses the XML you paste and generates strings. No outbound requests are made.

Where do I find the WSDL?

Append ?wsdl or ?WSDL to the service base URL (e.g. https://example.com/service.asmx?wsdl). Some services list the path in their homepage or error page.

What SOAP versions are supported?

SOAP 1.1 (the most common, uses http://schemas.xmlsoap.org/soap/envelope/) and SOAP 1.2 (uses http://www.w3.org/2003/05/soap-envelope). The tool detects the version from the binding and generates the correct envelope namespace.

Can I use this for CTF challenges?

Yes. SOAP services appear regularly in CTF web challenges. This tool cuts the time spent decoding WSDL XML and writing envelope boilerplate so you can focus on the actual vulnerability.

Why are my parameter values placeholders?

The tool inserts VALUE placeholders where the XSD type cannot be inferred as a primitive. Replace them with real values before sending the request.