OWASP (Open Web Application Security Project) Testing Guide v3 Released

Outsmart Malicious Hackers


This project’s goal is to create a “best practices” web application penetration testing framework which users can implement in their own organizations and a “low level” web application penetration testing guide that describes how to find certain issues.

Version 3 of the Testing Guide was released in last month in December 2008, the project was part of the OWASP Summer of Code, started on April 2008 reviewing the version 2 and improving it.

OWASP Testing Guide v3 is a 349 page book; they have split the set of active tests in 9 sub-categories for a total of 66 controls to test during the Web Application Testing activity.

Each control has an OWASP name, so for example a SQL Injection is called: OWASP-DV-005, meaning that it is the 5th control of the Data Validation category. They got a dream team of 21 authors and 4 reviewers: after 6 months of hard work and great team work we realized the v3.

The Guide is a “live” document: the project always needs your feedback! Please join the testing mailing list and share your ideas here.

You can download OWASP Testing Guide v3 here:

OWASP_Testing_Guide_v3.pdf

Download the presentation here
Browse the Testing Guide v3 on the wiki here

Or read more here.

Learn about Countermeasures



Posted in: Countermeasures, Web Hacking

, , ,

Latest Posts:


AWSBucketDump - AWS S3 Security Scanning Tool AWSBucketDump – AWS S3 Security Scanning Tool
AWSBucketDump is an AWS S3 Security Scanning Tool, which allows you to quickly enumerate AWS S3 buckets to look for interesting or confidential files.
nbtscan Download - NetBIOS Scanner For Windows & Linux nbtscan Download – NetBIOS Scanner For Windows & Linux
nbtscan is a command-line NetBIOS scanner for Windows that is SUPER fast, it scans for open NetBIOS nameservers on a local or remote TCP/IP network.
Equifax Data Breach - Hack Due To Missed Apache Patch Equifax Data Breach – Hack Due To Missed Apache Patch
The Equifax data breach is pretty huge with 143 million records leaked from the hack in the US alone with unknown more in Canada and the UK.
Seth - RDP Man In The Middle Attack Tool Seth – RDP Man In The Middle Attack Tool
Seth is an RDP Man In The Middle attack tool written in Python to MiTM RDP connections by attempting to downgrade the connection to extract clear text creds
dcrawl - Web Crawler For Unique Domains dcrawl – Web Crawler For Unique Domains
dcrawl is a simple, but smart, multithreaded web crawler for randomly gathering huge lists of unique domain names. It will branch out indefinitely.
Time Warner Hacked - AWS Config Exposes 4M Subscribers Time Warner Hacked – AWS Config Exposes 4M Subscribers
What's the latest on the web, Time Warner Hacked is what it's about now as a bad AWS S3 config (once again) exposes the details of approximately 4M subs.


One Response to OWASP (Open Web Application Security Project) Testing Guide v3 Released

  1. Bogwitch January 12, 2009 at 5:55 pm #

    The security assessments I have performed indicates that website developers and application developers have never heard of OWASP. When pointed to OWASP the remarks are often “But that’s about security, not web design” – and I think the problem stems from there. Web designers are all-to-often graphic artists, and have cut their teeth in environments where the application software they need to run, runs with elevated privileges, they have access to large portions of systems to aid in publication of content and therefore believe they are above security or that it doesn’t apply to them.