Abstract: The automatic tool of testing Web service vulnerability brings great effect on Web service-based software engineering,and they can effectively ensure the security and reliability of Web service-based software.According to Web service which is used widely,a prototype system WSVTS(Web Service Vulnerability Testing System) was designed and implemented．Two mutation approaches of testing Web service vulnerability based on the input domain of SOAP message,namely the worst-input mutation approach and fuzz data-input mutation approach,were implemented．Based on the two approaches,two test cases generation algorithms which are Test Cases generation based on Farthest Neighbor (TCFN) and Fuzz Data-input Mutation Algorithm (FDMA) were also implemented.Then,the test cases generated by the algorithms were executed in the SOAP requesting message.The vulnerability of the Web services can be detected by the response message of the client.

Key words: Web service,SOAP messages,Vulnerability testing,Test cases,Mutation operators,Prototype system