Testing web services that are accessible via service oriented architecture (SOA) interceptors

A system for testing web service-related elements, the system comprising:

• a processor;
• and
• storage coupled to the processor, wherein the storage stores computer program instructions, wherein the computer program instructions, when executed by the processor, perform:
• statically analyzing instructions of a plurality of web service-related elements, including a target web service-related element to identify a characteristic of an output of each web service-related element, wherein the target web service-related element is a web service exposed application programming interface (API);
• determining that at least two of the plurality of web service-related elements have a same output;
• in response to determining that at least two of the plurality of web service-related elements have the same output, determining an input condition for each of the at least two of the plurality of web service-related elements that results in the same output;
• synthesizing an attack on the target web service-related element using the characteristic of the same output of the target web service-related element and the input condition that results in the same output;
• presenting the attack in the form of a web service request to attempt to reach the target web service-related element through a plurality of other web-service related elements layered with respect to each other;
• receiving a response to the web service request sent to the target web service-related element through one or more of the other web-service related elements;
• and
• in response to determining that at least a portion of the response matches the characteristic of the output of the target web service-related element, determining that the web service request was processed by the target web service-related element.

A computer program product for testing web service-related elements, the computer program product comprising:

• a computer-readable storage device;
• and computer-readable program code embodied in the computer-readable storage device, wherein the computer-readable program code is configured to:
• statically analyze instructions of a plurality of web service-related elements, including a target web service-related element to identify a characteristic of an output of each web service-related element, wherein the target web service-related element is a web service exposed application programming interface (API);
• determining that at least two of the plurality of web service-related elements have a same output;
• in response to determining that at least two of the plurality of web service-related elements have the same output, determining an input condition for each of the at least two of the plurality of web service-related elements that results in the same output;
• synthesizing an attack on the target web service-related element using the characteristic of the same output of the target web service-related element and the input condition that results in the same output;
• presenting the attack in the form of the web service request to attempt to reach the target web service-related element through a plurality of other web-service related elements layered with respect to each other;
• receive a response to the web service request sent to the target web service-related element through one or more of the other web-service related elements;
• in response to determining that at least a portion of the response matches the characteristic of the output of the target web service-related element, determine that the web service request was processed by the target web service-related element.