Parasoft's SOAPtest 4.0, the most recent release of the product, gets excellent marks for features that help users secure Web applications. Many enhanced features are provided, including convenient configuration options and an updated graphical user interface (GUI). During testing, the focus was primarily on penetration testing, but SOAPtest 4.0 has a new metaphor that presents project navigation and testing control abilities in an Internet Explorer (IE) design. Also included are new regression-testing features that are powerful and more user-friendly than those of the initial version. Testers used a wizard to set up a series of eXtensible Markup Language (XML)- and non-XML-specific penetration tests against a .NET Web service. When the wizard had completed, a series of tests were displayed that could be manipulated for parameter generation and success/failure conditions. Parameters can be generated from a static file, use those stipulated by the user, or use scripting languages, such as JavaScript and Python. Testers found multiple views of requests that were generated to be impressive. They could view requests as raw XML, in a form that needed no expertise in XML or SQL, or as a hybrid with inputs for SOAP-specific values in the headers and body. The vendor explains that SOAPtest does not attempt to exploit vulnerabilities, but runs tests that allow the software to infer the vulnerability of service, which is a sensible approach. SOAPtest 4.0 does automated testing of common Simple Object Access Protocol (SOAP) and XML vulnerabilities, supports configurable dependencies for testing a composite application in the flow, and supports Hypertext Transport Protocol (HTTP) 1.0 and 1.1 and JMS as SOAP transports.