Guide for Web App Security Testing - A Framework for Penetration Testers and Organizations Worldwide - reading and correcting spelling mistakes

Oct 13, 2026

Upload by Blitz

OWASP Web Security Testing Guide (WSTG) provides a comprehensive framework of best practices for testing the security of web applications. It supports collaborative, globally used methodologies for penetration testers and organizations, including how to reference scenarios with versioned identifiers to avoid confusion between releases. The guide categorizes active testing into twelve scenario groups, covering information gathering, configuration, identity, authentication, authorization, sessions, input validation, and error handling, and it also explains key cryptography, business logic, client-side, and API testing areas, alongside passive reconnaissance techniques.

LanguageEnglish

CategoryGeneral

FormatPDF

Pages3

Reading Time1 min

AccessFree to download

Active Testing Categories

Information Gathering

Configuration and Deployment Management

Identity Management

Authentication

Authorization

Session Management

Input Validation

Error Handling

Security Testing Concepts

Vulnerability Identification

Cryptography Testing

Business Logic Testing

Client-side and UI Testing

API Testing

Passive Testing and Reconnaissance

Welcome to OWASP's official repository for the Web Security Testing Guide (WSTG), a comprehensive guide to testing web application security. The guide was created through collaborative efforts between security professionals and volunteers, providing a framework of best practices used globally by penetration testers and organizations. Currently working on release version 5.0, you can access the current document on GitHub or check the last stable release (4.2) available online. Each scenario has a unique identifier in the format WSTG--, where 'category' is a 4-character upper-case string and 'number' is a zero-padded numeric value from 01 to 99 . For instance, WSTG-INFO-02 represents the second Information Gathering test. To avoid confusion due to changing identifiers between versions, it's recommended to use the format WSTG--- . This includes including the version tag with punctuation removed, like WSTG-v42-INFO-02, which specifically refers to the second Information Gathering test from version 4.2 . If only the identifier is used without the element, it should be assumed to refer to the latest guide content. However, to avoid problems as the guide grows and changes, linking to scenarios should use versioned links instead of stable or latest links, which may change over time. The project team's intention is for versioned links not to change, like where the v42 element refers to version 4.2 . We are actively seeking new contributors! To get started, read our contribution guide or follow GitHub's suggestions for first-time contributors. This project is only possible due to the dedication of many volunteers. Everyone is encouraged to help in various ways, whether it's reading and correcting spelling mistakes, helping with translations, fixing existing issues, reporting opportunities for improvement, or contributing to the guide content itself. Successful contributors will be listed among the authors, reviewers, or editors and can be reached through our Slack channel or @owasp_wstg on Twitter. We're also part of a Google Group where you can share ideas, ask questions, or even share your favorite recipes! Open Web Application Security Project and OWASP are registered trademarks of the OWASP Foundation, Inc., while WSTG is a trademark of the same foundation. Guide for Web App Security Testing: A Framework for Penetration Testers and Organizations Worldwide. The guide outlines best practices for identifying and fixing common web app security issues. It's essential reading for anyone involved in web security testing. More details can be found on the official OWASP website or downloaded as a PDF file. Web application testing can be categorized into two main types: passive and active. Active Testing: During active testing, a tester employs methodologies described in the following sections. Twelve categories of active tests have been identified: 1 . Information Gathering: Collecting data about the target app and its environment. 2. Configuration and Deployment Management: Verifying configuration settings for servers, databases, or web services. 3. Identity Management: Testing user registration, account management, password policies, and profile management. 4. Authentication: Evaluating login, logout, password recovery, and multi-factor authentication mechanisms. 5. Authorization: Assessing role-based access control, privilege escalation, and horizontal/vertical access control. 6. Session Management: Testing session creation, maintenance, termination, and hijacking procedures. 7. Input Validation: Verifying data sanitization, encoding, filtering, and input validation mechanisms to prevent SQL injection, XSS, or command injection. 8. Error Handling: Examining error messages, logs, and debug information for potential security vulnerabilities. These categories help identify weaknesses in web application security, enabling testers and organizations to take corrective action. Testing for vulnerabilities involves identifying weaknesses or flaws

FAQs

What is OWASP WSTG used for?

OWASP WSTG is a comprehensive guide that provides best-practice methodologies for testing web application security and identifying vulnerabilities to improve security posture.

How should WSTG scenario identifiers be referenced across versions?

Use versioned links and the recommended identifier format (with the appropriate version tag) to avoid confusion caused by changing identifiers between releases.

What are the two main types of web application security testing mentioned?

The guide categorizes testing into passive and active. Active testing follows defined methodologies across multiple scenario categories, while passive testing focuses on reconnaissance and information gathering.

Oct 13, 2026

Upload by Blitz