Which tool is described as open-source with plugins for different attack types to test web services?

• A. SoapUI Pro
• B. XMLSpy
• C. Web API
• D. WS-Attacker

Answer: (D)

Testing web services for security often hinges on a tool that is both open-source and easily extended with different attack patterns. WS-Attacker fits this role. It’s a modular framework designed specifically to assess web services security by applying a variety of attacks against SOAP and related web service protocols, and its architecture supports adding new attack types through plugins or modules. This makes it ideal for simulating real-world scenarios and evaluating how a service holds up under different threat vectors.

In contrast, SoapUI Pro is a commercial API testing tool focused more on functional testing and API validation, not on a plugin-based attack framework. XMLSpy is primarily an XML editor and development tool, not a security testing framework. “Web API” is a generic term and doesn’t point to a specific open-source attack-oriented tool with plugin capabilities. So the open-source, plugin-extensible nature for security-focused web service testing is what points to WS-Attacker.