SoappUI OSS Cheat Sheets

api_testing_selfstudy.md

Self-guided Study and Practice for API Testing

Hands-on Practice

Evil Tester - REST API Challenges

• this is a highly structured self-study course that you can use online or run on your machine
• general API testing
• slightly gamified approach; it tracks your progress

30 Days of API Testing

• form your own study group and do this together

Bankground API

• general ApI testing, REST and GraphQL apis
• self-guided course, no feedback on progress

Damn Vulnerable Web Application

• recommended to use as a local VM
• written in PHP

Damn Vulnerable Web Service

• web service with xml related vulnerabilities
• written in nodeJS

Exploring Service APIs through Automation

• the course is taught using Postman, but all of these tasks can be done in SoapUI
• uses the restfulbooker api
• focus on using POISED api test heuristic (Parameters, Output, Interop, Security, Errors, and Data)

Owasp crAPI

• security, REST api

Owasp WebGoat

• security, full stack webapp with SOAP web service
• structured guided study

Owasp Juice Shop

• security, full stack JS webapp

VamPI

• a vulnerable REST api using open Api v3
• written in Python
• has an "on/off" vulnerable mode

Restful Booker

• general API testing, REST api

Books and Blogs

https://cse.google.com/cse?cx=partner-pub-4494420772031453:2717605672&ie=UTF-8&q=soapUI&sa=Search&ref=cse.google.com/

Followup Topics

Shield Right - Protecting the API at runtime

https://securityboulevard.com/2021/04/shield-right-while-shifting-left-to-eliminate-fdx-api-security-gaps-at-runtime-2/

https://www.devprojournal.com/software-development-trends/devops/a-balancing-act-shielding-right-while-shifting-left/