0

Currently I am working on a project in which I am supposed to define the following aspects as a test manager:

  • Conception of a penetration test for a test staging environment
  • Planning security guidelines for REST API development
  • Use of REST API scans via SOAPUI (create security test cases)

So my planning within the staging environment includes functional test procedures, integration test, as well as test procedures on the RESTAPI level. I am however undecided whether the pure security test about the SOAPUI solution alone is enough to get a high security coverage.

Therefore I plan another possibility in the test environment with even more special tools which besides the RestAPI level also : Integration of W3af or Vooki into the staging environment.

Questions: Is a security test drive via SOAPUI sufficient ? Should I use a different tool in the Stage (Pre Production) and in the Production? Should I test Security Test with another tool within the staging environment?

1

SOAPUI is a good tool to execute a DAST (Dynamic Application Security Testing). Another good open source tool is OWASP ZAP. There are also a bunch of commercial ones.

It's not the tool you are testing with, but the web attack payloads it runs against your application. If two of the tools have the same web attack payloads, there is no need to use another one.

You could also potentially do tests like SAST (Static Application Security Testing) which analyzes your source code for vulnerabilities before deployment or SCA (Software Composition Analysis) which would check for vulnerabilities in your third party dependencies you are using.

  • Hi, Raimonds, based on your answers, we will use Sonarqube as a static test framework. Owasp ZAP is of course a solution, but at least it doesn't seem to have a direct connection to RestAPI Test. – Mornon Aug 1 '19 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.