OWASP WSTG.

The OWASP Web Security Testing Guide, a comprehensive open-source manual that describes how to test web applications for the most common security weaknesses. It belongs to the Compliance & Frameworks category of cybersecurity.

The OWASP Web Security Testing Guide, a comprehensive open-source manual that describes how to test web applications for the most common security weaknesses.

The OWASP Web Security Testing Guide (WSTG) is an open-source, community-maintained handbook that documents techniques and test cases for penetration testing and security assessment of web applications. Version 4.2 organizes content into chapters such as Information Gathering, Configuration Management, Identity Management, Authentication, Authorization, Session Management, Input Validation, Error Handling, Cryptography, Business Logic, Client-side, and API Testing, each containing detailed test IDs (e.g. WSTG-AUTHN-01). Each test describes objectives, how to test, and references. The WSTG is used as the basis for many pentest methodologies, RFP testing requirements, and as a learning resource alongside ASVS and the Top 10.

Defences for OWASP WSTG typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Web Security Testing Guide, WSTG.