DOCSEARCHbyAlgolia
Submit Docs

OWASP Web Security Testing Guide

repository·master·Indexed 27 days ago

https://github.com/owasp/wstg

A professional framework and comprehensive guide for testing the security of web applications and web services. It provides a complete testing framework covering the what, why, when, where, and how of web application testing, including a checklist (v4.2), threat modeling, source code review, and strategies for integrating security into the Software Development Lifecycle (SDLC).

Tokens
135.7K
Snippets
184
Records
787
Agent score
94%

What's inside OWASP WSTG

  1. Overview of WSTG-BUSL-10: Test Payment Functionality

    master
    The WSTG-BUSL-10 test scenario focuses on evaluating the security and robustness of payment implementations in applications such as e-commerce sites, subscription services, charities, and currency exchanges. The goal is to identify vulnerabilities that could lead to financial theft, fraudulent purchases, or the theft of payment card details, which may result in regulatory fines and reputational damage.

  2. Overview of Oracle PL/SQL Gateway Testing

    master
    Testing focuses on the PL/SQL Gateway, the component responsible for translating web requests into database queries. Vulnerabilities can exist in various implementations, including the early web listener, the Apache mod_plsql module, and the XML Database (XDB) web server. Target products often include Oracle HTTP Server, eBusiness Suite, Portal, HTMLDB, WebDB, and Oracle Application Server.

  3. Understand SQL Injection Testing (WSTG-INPV-05)

    master

    SQL injection testing (ID: WSTG-INPV-05) verifies if an application allows the injection of user-controlled data to execute unauthorized SQL queries. This occurs when user input is used to construct dynamic SQL statements without proper validation.

    Attack Classes

    • Inband: Data is extracted using the same communication channel used to inject the code (e.g., results appear directly on the webpage).
    • Out-of-band: Data is retrieved via a different channel, such as an email or an external HTTP connection.
    • Inferential (Blind): No data is directly transferred; instead, information is reconstructed by observing the database server's behavior (e.g., response changes or delays).

  4. Bypass Filters using Multi-byte Encoding

    master
    Multi-byte encoding (a type of variable-width encoding) uses varying numbers of bytes to represent characters, commonly used for large character sets like Chinese, Japanese, or Korean. Attackers use these multi-byte sequences to carry out XSS or SQL injection attacks by slipping special characters past standard input validation functions that do not account for multi-byte representations.

  5. Perform Configuration and Deployment Management Testing

    master
    The Configuration and Deployment Management Testing section provides a suite of security testing scenarios focused on verifying the security of the application's environment, infrastructure, and deployment settings. Use these scenarios to identify misconfigurations in network infrastructure, application platforms, HTTP headers, and cloud storage.

  7. Understand the WSTG testing framework approach

    master
    The OWASP Web Security Testing Guide (WSTG) provides a complete testing framework rather than a simple checklist. It is designed to be used as a template to build custom testing programs or to qualify existing security processes. The framework covers the what, why, when, where, and how of web application testing, moving beyond simple penetration testing to integrate security into the entire Software Development Lifecycle (SDLC).

  9. Perform Business Logic Testing

    master

    Business Logic Testing focuses on identifying vulnerabilities in the application's functional design and implementation. This section of the WSTG provides specific testing scenarios to identify flaws in how an application handles business rules and workflows.

    Key testing areas include:

    • Data Validation: Verifying that business logic correctly validates data inputs.
    • Request Forgery: Testing the ability to forge or manipulate requests to bypass logic.
    • Integrity Checks: Ensuring the application maintains data integrity during operations.
    • Process Timing: Checking for vulnerabilities related to the timing of business processes.
    • Function Limits: Testing limits on how many times a specific function can be used.
    • Workflow Circumvention: Attempting to bypass intended application workflows.
    • Application Misuse: Testing defenses against intentional misuse of application features.
    • File Uploads: Testing for unexpected file types and malicious file uploads.
    • Payment Functionality: Verifying the security and integrity of payment processing flows.

  10. Identify weak cryptographic primitives (WSTG-CRYP-04)

    master
    Identify weak encryption or hashing implementations to prevent sensitive data exposure, key leakage, and spoofing. Avoid algorithms like MD5, RC4, DES, Blowfish, and SHA1. Ensure appropriate parameter usage, such as avoiding ECB mode for symmetric encryption and ensuring random, unpredictable Initialization Vectors (IV) for AES.

  12. Understand Cross-Site Request Forgery (CSRF) Vulnerabilities

    master

    Cross-Site Request Forgery (CSRF) is an attack that forces an authenticated user to execute unintended actions on a web application. The attack succeeds when an application relies solely on information automatically provided by the browser (such as cookies or HTTP-based authentication like Basic Auth) to identify a session, without requiring additional proof of intent from the user.

    Core Requirements for CSRF:

    1. Browser Behavior: The browser automatically sends session-related information (cookies, HTTP auth) with requests to the target site.
    2. Attacker Knowledge: The attacker knows valid URLs, parameters, or functional endpoints of the application.
    3. Session Management Flaw: The application relies exclusively on browser-managed credentials for authentication/authorization.
    4. Trigger Mechanism: The existence of HTML tags (like <img>) or links that trigger automatic HTTP requests.