Security test within a staging environment. Is SOAPUI sufficient as a test tool?

Question

Currently I am working on a project in which I am supposed to define the following aspects as a test manager:

• Conception of a penetration test for a test staging environment
• Planning security guidelines for REST API development
• Use of REST API scans via SOAPUI (create security test cases)

So my planning within the staging environment includes functional test procedures, integration test, as well as test procedures on the RESTAPI level. I am however undecided whether the pure security test about the SOAPUI solution alone is enough to get a high security coverage.

Therefore I plan another possibility in the test environment with even more special tools which besides the RestAPI level also : Integration of W3af or Vooki into the staging environment.

Questions: Is a security test drive via SOAPUI sufficient ? Should I use a different tool in the Stage (Pre Production) and in the Production? Should I test Security Test with another tool within the staging environment?

Answer 1

SOAPUI is a good tool to execute a DAST (Dynamic Application Security Testing). Another good open source tool is OWASP ZAP. There are also a bunch of commercial ones.

It's not the tool you are testing with, but the web attack payloads it runs against your application. If two of the tools have the same web attack payloads, there is no need to use another one.

You could also potentially do tests like SAST (Static Application Security Testing) which analyzes your source code for vulnerabilities before deployment or SCA (Software Composition Analysis) which would check for vulnerabilities in your third party dependencies you are using.