To meet the growing need for web services security, Parasoft has introduced SOAPtest 4.0, which the company contends is "the first product to offer penetration testing as an integrated component of a comprehensive, automated Web services testing suite." SOAPtest 4.0 introduces automated, repeatable penetration testing at the message level to detect Web services security vulnerabilities.

"Parasoft SOAPtest helps companies overcome the vulnerabilities and roadblocks in developing secure, compliant, reliable Web services," said Wayne Ariola, vice president of corporate development at Parasoft. "Web services expose security vulnerabilities through commonplace flaws like X-path injections, XML bombs, runtime errors and buffer overflows. SOAPtest 4.0 is an essential tool for enterprises deploying Web services to ensure their mission-critical applications are secure."

First launched three years ago, SOAPtest is used by hundreds of organizations worldwide to validate the reliability, compliance and performance of their business critical Web services deployments.

SOAPtest 4.0 introduces automated, repeatable penetration testing at the message level to detect Web services security vulnerabilities. Additional key features include support for UDDI Registry, WS-Addressing and WS-ReliableMessaging. SOAPtest 4.0 is the now the only enterprise-class product of its kind to embed attack scenarios into automated and repeatable functional testing of service-oriented architecture while testing compliance to the WS standards.

"As we continue to leverage Web services to deliver critical business data, it is imperative that our security infrastructure is trusted and reliable," said Cort Bucher, senior director of technology for McGraw-Hill Construction. "Parasoft SOAPtest 4.0's capability to automatically generate penetration tests custom to our Web services implementation provides me with the assurance that our services are truly production ready."

The five main new features in SOAPtest 4.0 are as follows:

1. Security penetration testing at the message level including SQL injections, XML bombs, parameter fuzzing, and XPath injections.
2. UDDI Registry support including a Query UDDI Tool that can be used to send inquiries to a UDDI registry for verification and validation.
3. WS-Addressing and WS-ReliableMessaging support including automatic generation of WS-Addressing and WS-ReliableMessaging headers within the SOAP header.
4. Test Suite "Wizard" that allows automatic creation of security penetration tests, asynchronous test suites, and tests from WSDL, WSIL, UDDI, and HTTP traffic.
5. Load testing improvements including a bottom-up approach that allows users to define the exact number of virtual users for each profile.

SOAPtest 4.0 is available for Windows 2000, Windows XP, Linux and Solaris, says Parasoft, and pricing starts at $3,495.