Skip to main content Skip to bottom of page

(opens in new window)

OWASP Web Security Testing Guide

Latest

Web application security testing guidance.

This content represents the latest contributions to the Web Security Testing Guide, and may frequently change.

WSTG Contents

Filter contents

0. Foreword
1. About
2. Introduction
3. The OWASP Testing Framework
- 3.1 The Web Security Testing Framework
- 3.8 Penetration Testing Methodologies
4. Web Application Security Testing
5. Reporting
- 5.1 Reporting Structure
- 5.2 Naming Schemes
Appendix A. History
Appendix B. Testing Tools Resource
Appendix C. Suggested Reading
Appendix D. Fuzzing
Appendix E. Encoded Injection
Appendix F. Leveraging Dev Tools

Credentials Transported over an Encrypted Channel

ID
WSTG-ATHN-01

This content has been merged into: Sensitive Information Sent via Unencrypted Channels

An OWASP Foundation project. About OWASP

OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.

© 2026, OWASP Foundation Inc. All rights reserved.