Navigation



OWASP (Open Web Application Security Project) Testing Guide v3 Released

Last updated: September 9, 2015 | 7,507 views

This project’s goal is to create a “best practices” web application penetration testing framework which users can implement in their own organizations and a “low level” web application penetration testing guide that describes how to find certain issues.

Version 3 of the Testing Guide was released in last month in December 2008, the project was part of the OWASP Summer of Code, started on April 2008 reviewing the version 2 and improving it.

OWASP Testing Guide v3 is a 349 page book; they have split the set of active tests in 9 sub-categories for a total of 66 controls to test during the Web Application Testing activity.

Each control has an OWASP name, so for example a SQL Injection is called: OWASP-DV-005, meaning that it is the 5th control of the Data Validation category. They got a dream team of 21 authors and 4 reviewers: after 6 months of hard work and great team work we realized the v3.

The Guide is a “live” document: the project always needs your feedback! Please join the testing mailing list and share your ideas here.

You can download OWASP Testing Guide v3 here:

OWASP_Testing_Guide_v3.pdf

Download the presentation here
Browse the Testing Guide v3 on the wiki here

Or read more here.

Share
Tweet
Share
Buffer
WhatsApp
Email
0 Shares
Posted in: Countermeasures, Web Hacking

, , ,


Latest Posts:


dSploit APK Download - Hacking & Security Toolkit For Android dSploit APK Download – Hacking & Security Toolkit For Android
dSploit APK Download is a Hacking & Security Toolkit For Android which can conduct network analysis and penetration testing activities.
January 15, 2020 - 143 Shares
Scallion - GPU Based Onion Hash Generator Scallion – GPU Based Onion Hash Generator
Scallion is a GPU-driven Onion Hash Generator written in C#, it lets you create vanity GPG keys and .onion addresses (for Tor's hidden services).
January 10, 2020 - 217 Shares
WiFi-Dumper - Dump WiFi Profiles and Cleartext Passwords WiFi-Dumper – Dump WiFi Profiles and Cleartext Passwords
WiFi-Dumper is an open-source Python-based tool to dump WiFi profiles and cleartext passwords of the connected access points on a Windows machine.
December 19, 2019 - 304 Shares
truffleHog - Search Git for High Entropy Strings with Commit History truffleHog – Search Git for High Entropy Strings with Commit History
truffleHog is a Python-based tool to search Git for high entropy strings, digging deep into commit history and branches. This is effective at finding secrets accidentally committed.
December 2, 2019 - 173 Shares
AIEngine - AI-driven Network Intrusion Detection System AIEngine – AI-driven Network Intrusion Detection System
AIEngine is a next-generation interactive/programmable Python/Ruby/Java/Lua and Go AI-driven Network Intrusion Detection System engine with many capabilities.
November 25, 2019 - 145 Shares
Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.
November 1, 2019 - 163 Shares


One Response to OWASP (Open Web Application Security Project) Testing Guide v3 Released

  1. Bogwitch January 12, 2009 at 5:55 pm #

    The security assessments I have performed indicates that website developers and application developers have never heard of OWASP. When pointed to OWASP the remarks are often “But that’s about security, not web design” – and I think the problem stems from there. Web designers are all-to-often graphic artists, and have cut their teeth in environments where the application software they need to run, runs with elevated privileges, they have access to large portions of systems to aid in publication of content and therefore believe they are above security or that it doesn’t apply to them.