OWASP/wstg resource

Health v2 · maintenance only

Adoption not part of the score

9755 stars · 1666 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

The OWASP Web Security Testing Guide (WSTG) is a comprehensive, community-maintained guide to testing the security of web applications and web services. It provides a framework of best practices and numbered test scenarios (e.g., WSTG-INFO-02) used by penetration testers and organizations worldwide.

Use cases

• learn how to pentest web applications
• find a checklist of web app security tests
• reference standard test IDs in a pentest report
• prepare for bug bounty hunting on web targets
• train developers on application security testing
• build a security testing methodology for web services

When to choose

• you need an authoritative, vendor-neutral reference for web application security testing
• you want standardized test identifiers to cite in security reports
• you are training a security team or learning penetration testing

When to avoid

• you need an automated scanning tool rather than a written guide
• you are looking for mobile, network, or firmware security testing guidance (see other OWASP guides)
• you need executable test scripts or tooling

Facets

learning-resource · maturity active

penetration-testing security documentation security penetration-testing web-development documentation cross-platform owasp appsec web-security pentesting bugbounty best-practices guide

Member repositories

For agents

markdown · JSON · MCP: product_card(name="OWASP/wstg")