...

Because penetration testing can take a long time to run, even for a single API, the Penetration Testing Tool has a built-in timeout that governs how long the tool will run before moving on to the next test. The timeout complies with the timeout configured in the test configuration used to run the test. If the timeout is reached before the penetration testing for the current API is complete, the penetration testing for that API will be interrupted and an error will be reported. To change the timeout

Additionally, you can set global includes and excludes, added as regular expressions, to control what URLs get scanned by the Penetration Testing Tool. Includes are processed before excludes. When no includes are defined, everything is assumed to be included before considering excludes. Includes and excludes get applied regardless of the tool to which the Penetration Testing Tool is chained.

To change the timeout and/or includes and excludes, go to Parasoft > Test Configurations, then select the test configuration and go to Execution > Security.

 Image Added

• The timeout is measured in minutes.
• To add a regular expression used to determine included or excluded URLs, click Add beside its table and input the regular expression.
• To remove a previously added URL regular expression, select it and click Remove.

When your penetration test scenarios run, information about what is being scanned is shown in the Console view. It can be valuable to enable high verbosity in the console, which will provide more detail such as what URLs are being scanned and which are being skipped, allowing you to ensure that your include and exclude patterns are performing as expected. To enable high verbosity, go to Parasoft > Test Configurations, then select the test configuration and go to Execution > Security.

Image Removed 

Preferences > Console and select High.

Reviewing Results

When running via UI, errors are reported to the Quality Tasks view, and details about the error and how to fix it can be seen by double-clicking on each error or right-clicking and choosing View Details.

More detailed results are available by generating an HTML version of the report. The HTML report will organize the errors by CWE or OWASP 2021 Top 10 (as set in Parasoft> Preferences> Reports> API Security; note that it is not necessary to re-execute your tests after changing this setting), Risk, and Confidence.

For more information see Reviewing Results.

...

SOAtest's penetration testing uses active and passive scan rules to do its analysis. Active scan rules make additional (manipulated) requests to the API to attempt to discover security vulnerabilities.  In contrast, passive scan rules make no new requests to the application but instead analyze request/response data captured by the corresponding tool to discover security vulnerabilities. SOAtest leverages OWASP ZAP for penetration testing. 

SOAtest contains two three built-in penetration test profiles: one for REST APIs, and another one for SOAP APIs, and one for non-API requests for web resources. Each profile consists of an active scan policy and a set of passive scan rules. By default, a profile is chosen based on whether the configured test   makes a request to   a REST API or SOAP API, a SOAP API, or some other web resource (for example, HTML).

If you want to use a custom active scan policy, you can do so by exporting a scan policy from OWASP ZAP and configuring SOAtest to use it. The exported scan policy will configure the set of active scan rules that will be used by the Penetration Testing Tool. When using a custom active scan policy, an appropriate set of passive scan rules will be automatically used based on whether the request is made to a REST API or SOAP API.

...

1. Select Parasoft > Test Configuration to open the Test Configuration Manager.
2. Click New to create a new Test Configuration, or select an existing one.
3. Open the Test Configuration’s Execution > Security tab.
4. Choose Use custom scan policy.
   
5. Using the Browse button select your ZAP .policy file.

...

This folder contains the following active policy files:

• Parasoft SOAP.policy – used by Penetration Testing Tools attached to SOAP Clients.Parasoft REST.policy – used by Penetration Testing Tools attached to tools other than SOAP Clients.policy – Used for requests to SOAP APIs. This primarily includes Penetration Testing Tools attached to SOAP Clients, but can include other tools that make requests to SOAP APIs.
• Parasoft REST.policy – Used for requests to REST APIs. This primarily includes Penetration Testing Tools attached to REST Clients, but can include other tools that make requests to REST APIs including other client tools and Browser Playback Tools.
• Parasoft Web.policy – Used for requests to non-API web resources. This is only used for Penetration Testing Tools attached to Browser Playback Tools for non-API requests.

Once you’ve modified either of these policies, it will be used in the next Penetration Testing Tool invocation.

Penetration Testing Rules Supported

Integration with Burp Suite

...