Skip to main content Skip to bottom of page

(opens in new window)

OWASP Web Security Testing Guide

v4.1

Web application security testing guidance.

You're viewing a past version of the Web Security Testing Guide project. For the latest stable version, visit /stable.

WSTG Contents (v4.1)

Filter contents

0. Foreword by Eoin Keary
1. Frontispiece
2. Introduction
3. The OWASP Testing Framework
- 3.1 The Web Security Testing Framework
- 3.8 Penetration Testing Methodologies
4. Web Application Security Testing
5. Reporting
Appendix A. Testing Tools Resource
Appendix B. Suggested Reading
Appendix C. Fuzz Vectors
Appendix D. Encoded Injection
Appendix E. History

Appendix

Appendix A. Testing Tools Resource

Appendix B. Suggested Reading

Appendix C. Fuzz Vectors

Appendix D. Encoded Injection

Appendix E. History

An OWASP Foundation project. About OWASP

OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.

© 2026, OWASP Foundation Inc. All rights reserved.