Method, system and apparatus for assessing vulnerability in Web services

摘要

Disclosed is a computer implemented method for testing a Web service to determine whether the Web service is vulnerable to at least one known vulnerability. A test case is created and executed for the Web service to determine whether the Web service is vulnerable to the vulnerability. The test case is based on at least one vulnerability definition, at least one Web service operation or port, and at least one control request. The vulnerability definition includes information required to create a request and an expected result. Also disclosed is a computer implemented method of testing a Web service to determine whether the Web service complies with a policy, for example a security or vulnerability policy. A test case is created and executed for the Web service to determine if the Web service complies to the policy.