OWASP/wstg
Wstg
The Web Application Security Testing Guide is an open-source security testing standard and comprehensive framework of procedures for identifying vulnerabilities in web applications and services. It serves as a vulnerability assessment methodology and a web API security audit framework, providing a structured approach for conducting consistent and thorough security audits of web-based software.
The project utilizes a methodology-based audit framework and checklist-driven workflows to ensure repeatable discovery and exploitation steps. It organizes security tests through taxonomy-based vulnerability classification and modular domain decomposition, splitting the testing process into distinct focus areas such as authentication and input validation.
The framework covers broad capability areas including web application security testing, web service security auditing, and API security testing. It integrates scenario-based security testing and guideline-based remediation mapping to connect identified vulnerabilities to specific mitigation strategies.
Features
- Web Security Auditing - Provides a comprehensive set of procedures and frameworks for systematically auditing the security of web applications.
- Security Audit Workflows - Provides structured sequences of verification steps for conducting systematic security audits of web applications.
- Web Security Audit - Implements a repeatable sequence of discovery and exploitation steps to identify weaknesses in web services.
- Vulnerability Assessment and Testing - Provides a structured methodology for identifying security gaps through repeatable scenarios and verification steps.
- API Security Checklists - Provides detailed checklists and methodologies specifically for evaluating the security posture of APIs.
- Security Testing - Defines specific attack patterns and expected outcomes to verify the security posture of web applications.
- Vulnerability Assessment Frameworks - Provides a systematic framework to discover and document security risks in web applications.
- Web Application Penetration Testing - Offers a standardized approach for identifying and validating security flaws in web services.
- Web Application Security Testing Guides - Provides a comprehensive framework of procedures and best practices for identifying vulnerabilities in web applications and services.
- API Security Audit Frameworks - Provides a dedicated framework of methodologies and checklists for evaluating API security postures.
- Remediation Guides - Provides actionable documentation and guidance for resolving identified security vulnerabilities using industry best practices.
- Software Security Standards - Serves as a community-driven standard for conducting consistent and thorough audits of web-based software.
- Classification Taxonomies - Uses a hierarchical classification system to organize security tests for systematic auditing.
- Application Security - Comprehensive guide for testing web application security.
- Security Testing - Comprehensive guide for web application security testing.
