Skip to main content Skip to bottom of page

v4.2 ▾ Switch version

Switch version

Latest (Same page)
v4.2 (You are here)
v4.1 (Nearest section)
Stable (Now points to v4.2)

(opens in new window)

OWASP Web Security Testing Guide

An OWASP Flagship Project

Web application security testing guidance.

You're viewing the current stable version of the Web Security Testing Guide project.

WSTG Contents (v4.2)

Filter Contents

0. Foreword by Eoin Keary
1. Frontispiece
2. Introduction
3. The OWASP Testing Framework
- 3.1 The Web Security Testing Framework
- 3.8 Penetration Testing Methodologies
4. Web Application Security Testing
5. Reporting
Appendix A. Testing Tools Resource
Appendix B. Suggested Reading
Appendix C. Fuzz Vectors
Appendix D. Encoded Injection
Appendix E. History
Appendix F. Leveraging Dev Tools

4.12 API Testing

4.12.1 Testing GraphQL

An OWASP Foundation project. About OWASP

OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.

© 2026, OWASP Foundation Inc. All rights reserved.