Review By: Chris A. Grady
07/09/2010

Hacking Web Services, by Shreeraj Shah, is a well-written, effectively organized text that provides the reader with in-depth technical knowledge regarding Web service security. The initial chapters provide the reader a superb introduction to the basics of Web services, followed by a brief but concise look at the various building blocks of Web service technologies. Subsequent chapters further explore subjects such as “Web Services Security Framework” or “Web Services Attack Vectors.” The accompanying CD-ROM provides concrete and illustrative examples of the discussed ideas and tools.

The material is presented in a logical albeit technical manner. The chapters flow flawlessly from one concept to the next, each containing a case study or a narrative. A brief summary concludes each section. I never felt the need to seek answers elsewhere in the text or that something went unexplained.

I recently began actively testing Web-related code, and this book provides a nice introduction to Web services. Going through a number of sections and utilizing the CD-ROM, I felt that I was receiving a classroom lecture from the author. I never thought that the concept was overly complicated or used simply to fill pages.

This book does not offer a lot of substance to the non-Web-based application tester, but it is a handy reference for testers involved in Web-based applications. I like the explanations offered via CD-ROM, and I was able to apply the concepts in actual, real-world scenarios. The appendix is invaluable for finding additional resources in a convenient place. I did get the feeling though that the information might become obsolete in two to three years, but Hacking Web Services still will provide a fundamental knowledge base for this expanding domain.

Hacking Web Services provides a nice introduction to the security behind the ever-expanding Web services domain. The accompanying CD-ROM allows the user to see the tools and ideas in action and apply them to real life scenarios. It’s a must have for those involved with Web-based applications, from systems analysts to systems developers.