wstg Documentation

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

9,649 stars Unknown 1 file ยท ~3,411 tokens #application-security#appsec#best-practices#bugbounty#guide#hacking#hacktoberfest#owasp
RAW Doc

File: README.md

OWASP Web Security Testing Guide



Welcome to the official repository for the Open Worldwide Application Security Projectยฎ (OWASPยฎ) Web Security Testing Guide (WSTG). The WSTG is a comprehensive guide to testing the security of web applications and web services. Created by the collaborative efforts of security professionals and dedicated volunteers, the WSTG provides a framework of best practices used by penetration testers and organizations all over the world.

We are currently working on release version 5.0. You can read the current document here on GitHub.

For the last stable release, check release 4.2. Also available online.

How To Reference WSTG Scenarios

Each scenario has an identifier in the format WSTG-<category>-<number>, where: 'category' is a 4 character upper case string that identifies the type of test or weakness, and 'number' is a zero-padded numeric value from 01 to 99. For example:WSTG-INFO-02 is the second Information Gathering test.

The identifiers may change between versions. Therefore, it is preferable that other documents, reports, or tools use the format: WSTG-<version>-<category>-<number>, where: 'version' is the version tag with punctuation removed. For example: WSTG-v42-INFO-02 would be understood to mean specifically the second Information Gathering test from version 4.2.

If identifiers are used without including the <version> element, they should be assumed to refer to the latest Web Security Testing Guide content. As the guide grows and changes this becomes problematic, which is why writers or developers should include the version element.

Linking

Linking to Web Security Testing Guide scenarios should be done using versioned links not stable or latest, which will change with time. However, it is the project team's intention that versioned links do not change. For example: https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/01-Information_Gathering/02-Fingerprint_Web_Server.html. Note: the v42 element refers to version 4.2.

Contributions, Feature Requests, and Feedback

We are actively inviting new contributors! To start, read the contribution guide.

First time here? Here are GitHub's suggestions for first-time contributors to this repository.

This project is only possible thanks to the work of many dedicated volunteers. Everyone is encouraged to help in ways large and small. Here are a few ways you can help:

  • Read the current content and help us fix any spelling mistakes or grammatical errors.
  • Help with translation efforts.
  • Choose an existing issue and submit a pull request to fix it.
  • Open a new issue to report an opportunity for improvement.

To learn how to contribute successfully, read the contribution guide.

Successful contributors appear on the project's list of authors, reviewers, or editors.

Chat With Us

We're easy to find on Slack:

  1. Join the OWASP Group Slack with this invitation link.
  2. Join this project's channel, #testing-guide.

Feel free to ask questions, suggest ideas, or share your best recipes.

You can @ us on ๐• (Twitter) @owasp_wstg.

You can also join our Google Group.

Project Leaders

Core Team

Translations

Open Worldwide Application Security Project and OWASP are registered trademarks of the OWASP Foundation, Inc.

File: checklists/README.md

Web Security Testing Guide Checklist

Contained in this folder is an Excel file which provides the following worksheets:

  • Testing Checklist - facilitates simple progress tracking against each of the "tests" outlined in the guide.
  • Summary Findings - facilitates creating a table of test outcomes and potential recommendations.
  • Risk Assessment Calculator - a dropdown driven sheet for calculating likelihood and impact scores, and a qualitative overall risk rating.
  • References - provides the lists/sets that the calculator is based upon.

Note: The current (Excel) checklist is based on v4.2 of the OWASP Testing Guide, as content for other versions is still under development.

Excel File Hash

SHA-256: 9f21d94f37d3850712688e5550ed3e0cc8535280c6a201e28f19ba0c22b31de6

Google Sheets Template

The following instructions can be used to copy the Checklist spreadsheet template directly into a new Google sheet without having to save the doc locally first.

  1. Go to this Google Spreadsheet template
  2. Click Make a copy button. This will create a new checklist in your logged in Google Drive.
  3. You should now have a fully populated and functional Web Security Testing Guide Checklist in a Google sheet, with the four tabs as mentioned above.

File: document/6-Appendix/README.md

Appendix

Appendix A. Testing Tools Resource

Appendix B. Suggested Reading

Appendix C. Fuzzing

Appendix D. Encoded Injection

Appendix E. History

Appendix F. Leveraging Dev Tools

File: document/5-Reporting/README.md

Reporting

5.1 Reporting Structure

5.2 Naming Schemes

File: document/4-Web_Application_Security_Testing/12-API_Testing/README.md

4.12 API Testing

4.12.0 API Testing Overview

4.12.1 API Reconnaissance

4.12.2 API Broken Object Level Authorization

4.12.3 Testing for Excessive Data Exposure

4.12.4 API Broken Function Level Authorization

4.12.99 Testing GraphQL

File: document/4-Web_Application_Security_Testing/11-Client-side_Testing/README.md

4.11 Client-Side Testing

4.11.1 Testing for DOM-Based Cross Site Scripting

4.11.2 Testing for JavaScript Execution

4.11.3 Testing for HTML Injection

4.11.4 Testing for Client-side URL Redirect

4.11.5 Testing for CSS Injection

4.11.6 Testing for Client-side Resource Manipulation

4.11.7 Testing Cross Origin Resource Sharing

4.11.8 Testing for Cross Site Flashing

4.11.9 Testing for Clickjacking

4.11.10 Testing WebSockets

4.11.11 Testing Web Messaging

4.11.12 Testing Browser Storage

4.11.13 Testing for Cross Site Script Inclusion

4.11.14 Testing for Reverse Tabnabbing

4.11.15 Testing for Client-side Template Injection

File: document/4-Web_Application_Security_Testing/10-Business_Logic_Testing/README.md

4.10 Business Logic Testing

4.10.0 Introduction to Business Logic

4.10.1 Test Business Logic Data Validation

4.10.2 Test Ability to Forge Requests

4.10.3 Test Integrity Checks

4.10.4 Test for Process Timing

4.10.5 Test Number of Times a Function Can Be Used Limits

4.10.6 Testing for the Circumvention of Work Flows

4.10.7 Test Defenses Against Application Misuse

4.10.8 Test Upload of Unexpected File Types

4.10.9 Test Upload of Malicious Files

4.10.10 Test Payment Functionality

File: document/4-Web_Application_Security_Testing/09-Testing_for_Weak_Cryptography/README.md

4.9 Testing for Weak Cryptography

4.9.1 Testing for Weak Transport Layer Security

4.9.2 Testing for Padding Oracle

4.9.3 Testing for Sensitive Information Sent via Unencrypted Channels

4.9.4 Testing for Weak Cryptographic Primitives

File: document/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/README.md

4.8 Testing for Error Handling

4.8.1 Testing for Improper Error Handling

4.8.2 Testing for Stack Traces

File: document/4-Web_Application_Security_Testing/07-Input_Validation_Testing/README.md

4.7 Input Validation Testing

4.7.1 Testing for Reflected Cross Site Scripting

4.7.2 Testing for Stored Cross Site Scripting

4.7.3 Testing for HTTP Verb Tampering

4.7.4 Testing for HTTP Parameter Pollution

4.7.5 Testing for SQL Injection

4.7.6 Testing for LDAP Injection

4.7.7 Testing for XML Injection

4.7.8 Testing for SSI Injection

4.7.9 Testing for XPath Injection

4.7.10 Testing for IMAP SMTP Injection

4.7.11 Testing for Code Injection

4.7.12 Testing for Command Injection

4.7.13 Testing for Format String Injection

4.7.14 Testing for Incubated Vulnerability

4.7.15 Testing for HTTP Response Splitting

4.7.16 Testing for HTTP Request Smuggling

4.7.17 Testing for Host Header Injection

4.7.18 Testing for Server-side Template Injection

4.7.19 Testing for Server-Side Request Forgery

4.7.20 Testing for Mass Assignment

4.7.21 Testing for CSV Injection

4.7.22 Testing for Prototype Pollution

4.7.23 Testing for Insecure Deserialization

Explore Related Technologies & Topics

View All 9,111+ Repositories โ†’

Discover similar high-velocity repositories, agent skills, and OpenAPI specifications across the ecosystem.

#application-security Browse application-security catalog โ†’ #appsec Browse appsec catalog โ†’ #best-practices Browse best-practices catalog โ†’ #bugbounty Browse bugbounty catalog โ†’ #guide Browse guide catalog โ†’ #hacking Browse hacking catalog โ†’ โšก MCP Servers Model Context Protocol โ†’ ๐Ÿง  Agent Skills Prompt & rule files โ†’ ๐Ÿ”Œ OpenAPI Specs REST & Swagger schemas โ†’