Skip to content
OWASP Web Security Testing Guide v4.2
On Trove · from OWASP Foundation

OWASP Web Security Testing Guide v4.2

The OWASP Web Security Testing Guide (WSTG) is a comprehensive guide to testing the security of web applications.

Read a preview

You can read the contents and the first 2,000 characters.
Free accounts get the whole book.

  • By OWASP Foundation
  • 155 chapters
  • Updated Nov 1, 2026
  • 134 readers

What’s inside

  • Frontispiece
  • Introduction
  • The Web Security Testing Framework
  • Penetration Testing Methodologies
  • Web Application Security Testing
  • Testing Introduction and Objectives

What is OWASP Web Security Testing Guide v4.2?

The OWASP Web Security Testing Guide (WSTG) is a comprehensive guide to testing the security of web applications. It provides a framework of best practices used by penetration testers and security professionals worldwide, with 100+ individual test procedures covering information gathering, authentication, authorization, session management, input validation, cryptography, business logic, client-side, and API testing.

Read more

OWASP Foundation · markdown · Listed Feb 19, 2026

  • security
  • audit
  • best-practices
  • guide

From the first page

The OWASP Web Security Testing Guide (WSTG) is a comprehensive guide to testing the security of web applications and web services. Created by the collaborative efforts of cybersecurity professionals and dedicated volunteers, the WSTG provides a framework of best practices used by penetration testers and organizations all over the world.

This book contains the complete WSTG, organized by testing category. Each individual test procedure is identified by its WSTG-XXXX-NN code for easy reference.

The problem of insecure software is perhaps the most important technical challenge of our time. The dramatic rise of web applications enabling business, social networking etc has only compounded the requirements to establish a robust approach to writing and securing our internet, web applications, and data.

At the Open Worldwide Application Security Project® (OWASP®), we're trying to make the world a place where insecure software is the anomaly, not the norm. The OWASP Testing Guide has an important role to play in solving this serious issue. It is vitally important that our approach to testing software for security issues is based

Preview · 2,000 of 1,239,973 characters

Web Application Security for AI Agents
Inside Claude Code: The Architecture
UI/UX Design Principles for AI Agents
Hermes Agent: The Complete Developer Guide

Contents

  1. 01OWASP Web Security Testing Guide v4.2p.1
    1. About This Editionp.1
    2. Testing Categoriesp.1
  2. 02Forewordp.2
    1. Why OWASP?p.2
    2. Tailoring and Prioritizingp.2
    3. The Role of Automated Toolsp.2
    4. Call to Actionp.2
  3. 03Frontispiecep.3
    1. Welcomep.3
    2. Copyright and Licenseep.3
    3. Leadersp.3
    4. Core Teamp.3
    5. Authorsp.3
    6. Graphic Designersp.3
    7. Reviewers or Editorsp.3
    8. Trademarksp.3
    9. +1 more section
  4. 04Introductionp.4
    1. The OWASP Testing Projectp.4
    2. Principles of Testingp.4
    3. Testing Techniques Explainedp.4
    4. Manual Inspections and Reviewsp.4
    5. Threat Modelingp.4
    6. Source Code Reviewp.4
    7. Penetration Testingp.4
    8. The Need for a Balanced Approachp.4
    9. +4 more sections
  5. 05The Web Security Testing Frameworkp.5
    1. Overviewp.5
    2. Phase 1 Before Development Beginsp.5
    3. Phase 2 During Definition and Designp.5
    4. Phase 3 During Developmentp.5
    5. Phase 4 During Deploymentp.5
    6. Phase 5 During Maintenance and Operationsp.5
    7. A Typical SDLC Testing Workflowp.5
  6. 06Penetration Testing Methodologiesp.6
    1. Summaryp.6
    2. OWASP Testing Guidesp.6
    3. Penetration Testing Execution Standardp.6
    4. PCI Penetration Testing Guidep.6
    5. Penetration Testing Frameworkp.6
    6. Technical Guide to Information Security Testing and Assessmentp.6
    7. Open Source Security Testing Methodology Manualp.6
    8. Referencesp.6
  7. 07Web Application Security Testingp.7
  8. 08Testing Introduction and Objectivesp.8
    1. What is Web Application Security Testing?p.8
    2. What is a Vulnerability?p.8
    3. What is a Threat?p.8
    4. What is a Test?p.8
    5. The Approach in Writing this Guidep.8
    6. What Is the OWASP Testing Methodology?p.8
See all 155 parts
  1. 09Information Gatheringp.9
  2. 10WSTG-INFO-01: Conduct Search Engine Discovery Reconnaissance for Information Leakagep.10
    1. Summaryp.10
    2. Test Objectivesp.10
    3. How to Testp.10
    4. Remediationp.10
  3. 11WSTG-INFO-02: Fingerprint Web Serverp.11
    1. Summaryp.11
    2. Test Objectivesp.11
    3. How to Testp.11
    4. Remediationp.11
  4. 12WSTG-INFO-03: Review Webserver Metafiles for Information Leakagep.12
    1. Summaryp.12
    2. Test Objectivesp.12
    3. How to Testp.12
    4. Conforms to IETF `draft-foudil-securitytxt-07`p.12
    5. Toolsp.12
  5. 13WSTG-INFO-04: Attack Surface Identificationp.13
    1. Summaryp.13
    2. Test Objectivesp.13
    3. How to Testp.13
    4. Toolsp.13
  6. 14WSTG-INFO-05: Review Web Page Content for Information Leakagep.14
    1. Summaryp.14
    2. Test Objectivesp.14
    3. How to Testp.14
    4. Toolsp.14
    5. Referencesp.14
  7. 15WSTG-INFO-06: Identify Application Entry Pointsp.15
    1. Summaryp.15
    2. Test Objectivesp.15
    3. How to Testp.15
    4. Toolsp.15
    5. Referencesp.15
  8. 16WSTG-INFO-07: Map Execution Paths Through Applicationp.16
    1. Summaryp.16
    2. Test Objectivesp.16
    3. How to Testp.16
    4. Toolsp.16
    5. Referencesp.16
  9. 17WSTG-INFO-08: Fingerprint Web Application Frameworkp.17
    1. Summaryp.17
    2. Test Objectivesp.17
    3. How to Testp.17
    4. Common Identifiersp.17
    5. Remediationp.17
    6. Toolsp.17
    7. Referencesp.17
  10. 18WSTG-INFO-09: Fingerprint Web Applicationp.18
  11. 19WSTG-INFO-10: Map Application Architecturep.19
    1. Summaryp.19
    2. Test Objectivesp.19
    3. How to Testp.19
  12. 20Configuration and Deployment Management Testingp.20
  13. 21WSTG-CONF-01: Test Network Infrastructure Configurationp.21
    1. Summaryp.21
    2. Test Objectivesp.21
    3. How to Testp.21
    4. Referencesp.21
  14. 22WSTG-CONF-02: Test Application Platform Configurationp.22
    1. Summaryp.22
    2. Test Objectivesp.22
    3. How to Testp.22
    4. Referencesp.22
  15. 23WSTG-CONF-03: Test File Extensions Handling for Sensitive Informationp.23
    1. Summaryp.23
    2. Test Objectivesp.23
    3. How to Testp.23
    4. Toolsp.23
  16. 24WSTG-CONF-04: Review Old Backup and Unreferenced Files for Sensitive Informationp.24
    1. Summaryp.24
    2. Test Objectivesp.24
    3. How to Testp.24
    4. Remediationp.24
    5. Toolsp.24
  17. 25WSTG-CONF-05: Enumerate Infrastructure and Application Admin Interfacesp.25
    1. Summaryp.25
    2. Test Objectivesp.25
    3. How to Testp.25
    4. Toolsp.25
    5. Referencesp.25
  18. 26WSTG-CONF-06: Test HTTP Methodsp.26
    1. Summaryp.26
    2. Test Objectivesp.26
    3. How to Testp.26
    4. Remediationp.26
    5. Toolsp.26
    6. Referencesp.26
  19. 27WSTG-CONF-07: Test HTTP Strict Transport Securityp.27
    1. Summaryp.27
    2. Test Objectivesp.27
    3. How to Testp.27
    4. Referencesp.27
  20. 28WSTG-CONF-08: Test RIA Cross Domain Policyp.28
  21. 29WSTG-CONF-09: Test File Permissionp.29
    1. Summaryp.29
    2. Test Objectivesp.29
    3. How to Testp.29
    4. Remediationp.29
    5. Toolsp.29
    6. Referencesp.29
  22. 30WSTG-CONF-10: Test for Subdomain Takeoverp.30
    1. Summaryp.30
    2. Test Objectivesp.30
    3. How to Testp.30
    4. Remediationp.30
    5. Toolsp.30
    6. Referencesp.30
  23. 31WSTG-CONF-11: Test Cloud Storagep.31
    1. Summaryp.31
    2. Test Objectivesp.31
    3. How to Testp.31
    4. Toolsp.31
    5. Referencesp.31
  24. 32WSTG-CONF-12: Testing for Content Security Policyp.32
    1. Summaryp.32
    2. Test Objectivesp.32
    3. How to Testp.32
    4. Remediationp.32
    5. Toolsp.32
    6. Referencesp.32
  25. 33WSTG-CONF-13: Test Path Confusionp.33
    1. Summaryp.33
    2. Test Objectivesp.33
    3. How To Testp.33
    4. Toolsp.33
    5. Remediationp.33
    6. Referencesp.33
  26. 34WSTG-CONF-14: Test Other HTTP Security Header Misconfigurationsp.34
    1. Summaryp.34
    2. Test Objectivesp.34
    3. Common Security Header Misconfigurationsp.34
    4. Risks of Misconfigured Security Headersp.34
    5. How to Testp.34
    6. Remediationp.34
    7. Toolsp.34
    8. Referencesp.34
  27. 35Identity Management Testingp.35
  28. 36WSTG-IDNT-01: Test Role Definitionsp.36
    1. Summaryp.36
    2. Test Objectivesp.36
    3. How to Testp.36
    4. Toolsp.36
    5. Referencesp.36
  29. 37WSTG-IDNT-02: Test User Registration Processp.37
    1. Summaryp.37
    2. Test Objectivesp.37
    3. How to Testp.37
    4. Remediationp.37
    5. Toolsp.37
    6. Referencesp.37
  30. 38WSTG-IDNT-03: Test Account Provisioning Processp.38
    1. Summaryp.38
    2. Test Objectivesp.38
    3. How to Testp.38
    4. Toolsp.38
  31. 39WSTG-IDNT-04: Testing for Account Enumeration and Guessable User Accountp.39
    1. Summaryp.39
    2. Test Objectivesp.39
    3. How to Testp.39
    4. Remediationp.39
    5. Toolsp.39
    6. Referencesp.39
  32. 40WSTG-IDNT-05: Testing for Weak or Unenforced Username Policyp.40
  33. 41Authentication Testingp.41
  34. 42WSTG-ATHN-01: Testing for Credentials Transported over an Encrypted Channelp.42
  35. 43WSTG-ATHN-02: Testing for Default Credentialsp.43
    1. Summaryp.43
    2. Test Objectivesp.43
    3. How to Testp.43
    4. Toolsp.43
    5. Referencesp.43
  36. 44WSTG-ATHN-03: Testing for Weak Lock Out Mechanismp.44
    1. Summaryp.44
    2. Test Objectivesp.44
    3. How to Testp.44
    4. Remediationp.44
    5. Referencesp.44
  37. 45WSTG-ATHN-04: Testing for Bypassing Authentication Schemap.45
    1. Summaryp.45
    2. Test Objectivesp.45
    3. How to Testp.45
    4. Toolsp.45
    5. Referencesp.45
  38. 46WSTG-ATHN-05: Testing for Vulnerable Remember Passwordp.46
    1. Summaryp.46
    2. Test Objectivesp.46
    3. How to Testp.46
    4. Remediationp.46
  39. 47WSTG-ATHN-06: Testing for Browser Cache Weaknessesp.47
    1. Summaryp.47
    2. Test Objectivesp.47
    3. How to Testp.47
    4. Toolsp.47
    5. Referencesp.47
  40. 48WSTG-ATHN-07: Testing for Weak Authentication Methodsp.48
    1. Summaryp.48
    2. Test Objectivesp.48
    3. How to Testp.48
    4. Remediationp.48
    5. Referencesp.48
  41. 49WSTG-ATHN-08: Testing for Weak Security Question Answerp.49
    1. Summaryp.49
    2. Test Objectivesp.49
    3. How to Testp.49
    4. Referencesp.49
  42. 50WSTG-ATHN-09: Testing for Weak Password Change or Reset Functionalitiesp.50
    1. Summaryp.50
    2. Test Objectivesp.50
    3. How to Testp.50
    4. Referencesp.50
  43. 51WSTG-ATHN-10: Testing for Weaker Authentication in Alternative Channelp.51
    1. Summaryp.51
    2. Examplep.51
    3. Test Objectivesp.51
    4. How to Testp.51
    5. Related Test Casesp.51
    6. Remediationp.51
  44. 52WSTG-ATHN-11: Testing Multi-Factor Authentication (MFA)p.52
    1. Summaryp.52
    2. Test Objectivesp.52
    3. How to Testp.52
    4. Related Test Casesp.52
    5. Remediationp.52
    6. Referencesp.52
  45. 53Authorization Testingp.53
  46. 54WSTG-ATHZ-01: Testing Directory Traversal File Includep.54
    1. Summaryp.54
    2. Test Objectivesp.54
    3. How to Testp.54
    4. Toolsp.54
    5. Referencesp.54
  47. 55WSTG-ATHZ-02: Testing for Bypassing Authorization Schemap.55
    1. Summaryp.55
    2. Test Objectivesp.55
    3. How to Testp.55
    4. Remediationp.55
    5. Toolsp.55
    6. Referencesp.55
  48. 56WSTG-ATHZ-03: Testing for Privilege Escalationp.56
    1. Summaryp.56
    2. Test Objectivesp.56
    3. How to Testp.56
    4. Referencesp.56
    5. Toolsp.56
  49. 57WSTG-ATHZ-04: Testing for Insecure Direct Object Referencesp.57
    1. Summaryp.57
    2. Test Objectivesp.57
    3. How to Testp.57
    4. Referencesp.57
  50. 58WSTG-ATHZ-05: Testing for OAuth Weaknessesp.58
    1. Summaryp.58
    2. Test Objectivesp.58
    3. How to Testp.58
    4. Related Test Casesp.58
    5. Remediationp.58
    6. Toolsp.58
    7. Referencesp.58
  51. 59WSTG-ATHZ-05.1: Testing for OAuth Authorization Server Weaknessesp.59
    1. Summaryp.59
    2. Test Objectivesp.59
    3. How to Testp.59
    4. Related Test Casesp.59
    5. Remediationp.59
    6. Toolsp.59
    7. Referencesp.59
  52. 60WSTG-ATHZ-05.2: Testing for OAuth Client Weaknessesp.60
    1. Summaryp.60
    2. Test Objectivesp.60
    3. How to testp.60
    4. Related Test Casesp.60
    5. Remediationp.60
    6. Toolsp.60
    7. Referencesp.60
  53. 61Session Management Testingp.61
  54. 62WSTG-SESS-01: Testing for Session Management Schemap.62
    1. Summaryp.62
    2. Test Objectivesp.62
    3. How to Testp.62
    4. Toolsp.62
    5. Referencesp.62
  55. 63WSTG-SESS-02: Testing for Cookies Attributesp.63
    1. Summaryp.63
    2. Test Objectivesp.63
    3. How to Testp.63
    4. Toolsp.63
    5. Referencesp.63
  56. 64WSTG-SESS-03: Testing for Session Fixationp.64
    1. Summaryp.64
    2. Test Objectivesp.64
    3. How to Testp.64
    4. Remediationp.64
    5. Toolsp.64
    6. Referencesp.64
  57. 65WSTG-SESS-04: Testing for Exposed Session Variablesp.65
    1. Summaryp.65
    2. Test Objectivesp.65
    3. How to Testp.65
    4. Referencesp.65
  58. 66WSTG-SESS-05: Testing for Cross Site Request Forgeryp.66
    1. Summaryp.66
    2. Test Objectivesp.66
    3. How to Testp.66
    4. Remediationp.66
    5. Toolsp.66
    6. Referencesp.66
  59. 67WSTG-SESS-06: Testing for Logout Functionalityp.67
    1. Summaryp.67
    2. Test Objectivesp.67
    3. How to Testp.67
    4. Toolsp.67
    5. Referencesp.67
  60. 68WSTG-SESS-07: Testing Session Timeoutp.68
    1. Summaryp.68
    2. Test Objectivesp.68
    3. How to Testp.68
    4. Referencesp.68
  61. 69WSTG-SESS-08: Testing for Session Puzzlingp.69
    1. Summaryp.69
    2. Test Objectivesp.69
    3. How to Testp.69
    4. Remediationp.69
    5. Referencesp.69
  62. 70WSTG-SESS-09: Testing for Session Hijackingp.70
    1. Summaryp.70
    2. Test Objectivesp.70
    3. How to Testp.70
    4. Toolsp.70
  63. 71WSTG-SESS-10: Testing JSON Web Tokensp.71
    1. Summaryp.71
    2. Test Objectivesp.71
    3. How to Testp.71
    4. Related Test Casesp.71
    5. Remediationp.71
    6. Toolsp.71
    7. Referencesp.71
  64. 72WSTG-SESS-11: Testing for Concurrent Sessionsp.72
    1. Summaryp.72
    2. Test Objectivesp.72
    3. How to Testp.72
    4. Remediationp.72
    5. Recommended Toolsp.72
  65. 73Input Validation Testingp.73
  66. 74WSTG-INPV-01: Testing for Reflected Cross Site Scriptingp.74
    1. Summaryp.74
    2. Test Objectivesp.74
    3. How to Testp.74
    4. Toolsp.74
    5. Referencesp.74
  67. 75WSTG-INPV-02: Testing for Stored Cross Site Scriptingp.75
    1. Summaryp.75
    2. Test Objectivesp.75
    3. How to Testp.75
    4. Toolsp.75
    5. Referencesp.75
  68. 76WSTG-INPV-03: Testing for HTTP Verb Tamperingp.76
  69. 77WSTG-INPV-04: Testing for HTTP Parameter Pollutionp.77
    1. Summaryp.77
    2. Test Objectivesp.77
    3. How to Testp.77
    4. Toolsp.77
    5. Referencesp.77
  70. 78WSTG-INPV-05: Testing for SQL Injectionp.78
    1. Summaryp.78
    2. Test Objectivesp.78
    3. How to Testp.78
    4. Remediationp.78
    5. Toolsp.78
    6. Referencesp.78
  71. 79WSTG-INPV-05.1: Testing for Oraclep.79
    1. Summaryp.79
    2. How to Testp.79
    3. Toolsp.79
    4. Referencesp.79
  72. 80WSTG-INPV-05.2: Testing for MySQLp.80
    1. Summaryp.80
    2. How to Testp.80
    3. Toolsp.80
    4. Referencesp.80
  73. 81WSTG-INPV-05.3: Testing for SQL Serverp.81
    1. Summaryp.81
    2. How to Testp.81
    3. Toolsp.81
    4. Referencesp.81
  74. 82WSTG-INPV-05.4: Testing PostgreSQLp.82
    1. Summaryp.82
    2. How to Testp.82
    3. Referencesp.82
  75. 83WSTG-INPV-05.5: Testing for MS Accessp.83
    1. Summaryp.83
    2. How to Testp.83
    3. Referencesp.83
  76. 84WSTG-INPV-05.6: Testing for NoSQL Injectionp.84
    1. Summaryp.84
    2. How to Testp.84
    3. Referencesp.84
  77. 85WSTG-INPV-05.7: Testing for ORM Injectionp.85
    1. Summaryp.85
    2. How to Testp.85
    3. Referencesp.85
  78. 86WSTG-INPV-05.8: Testing for Client-sidep.86
    1. Summaryp.86
    2. Test Objectivesp.86
    3. How to Testp.86
    4. Remediationp.86
    5. Referencesp.86
  79. 87WSTG-INPV-06: Testing for LDAP Injectionp.87
    1. Summaryp.87
    2. Test Objectivesp.87
    3. How to Testp.87
    4. Toolsp.87
    5. Referencesp.87
  80. 88WSTG-INPV-07: Testing for XML Injectionp.88
    1. Summaryp.88
    2. Test Objectivesp.88
    3. How to Testp.88
    4. Source Code Reviewp.88
    5. Toolsp.88
    6. Referencesp.88
  81. 89WSTG-INPV-08: Testing for SSI Injectionp.89
    1. Summaryp.89
    2. Test Objectivesp.89
    3. How to Testp.89
    4. Toolsp.89
    5. Referencesp.89
  82. 90WSTG-INPV-09: Testing for XPath Injectionp.90
    1. Summaryp.90
    2. Test Objectivesp.90
    3. How to Testp.90
    4. Referencesp.90
  83. 91WSTG-INPV-10: Testing for IMAP SMTP Injectionp.91
    1. Summaryp.91
    2. Test Objectivesp.91
    3. How to Testp.91
    4. Referencesp.91
  84. 92WSTG-INPV-11: Testing for Code Injectionp.92
    1. Summaryp.92
    2. Test Objectivesp.92
    3. How to Testp.92
  85. 93WSTG-INPV-11.1: Testing for File Inclusionp.93
    1. Summaryp.93
    2. Test Objectivesp.93
    3. +4 more sections
  86. 94WSTG-INPV-12: Testing for Command Injectionp.94
    1. +10 more sections
  87. 95WSTG-INPV-13: Testing for Buffer Overflowp.95
  88. 96WSTG-INPV-13b: Testing for Format String Injectionp.96
    1. +3 more sections
  89. 97WSTG-INPV-14: Testing for Incubated Vulnerabilityp.97
    1. +5 more sections
  90. 98WSTG-INPV-15: Testing for HTTP Response Splittingp.98
    1. +6 more sections
  91. 99WSTG-INPV-16: Testing for HTTP Request Smugglingp.99
    1. +6 more sections
  92. 100WSTG-INPV-17: Testing for Host Header Injectionp.100
    1. +4 more sections
  93. 101WSTG-INPV-18: Testing for Server-side Template Injectionp.101
    1. +5 more sections
  94. 102WSTG-INPV-19: Testing for Server-Side Request Forgeryp.102
    1. +5 more sections
  95. 103WSTG-INPV-20: Testing for Mass Assignmentp.103
    1. +5 more sections
  96. 104Error Handling Testingp.104
  97. 105WSTG-ERRH-01: Testing for Improper Error Handlingp.105
    1. +6 more sections
  98. 106WSTG-ERRH-02: Testing for Stack Tracesp.106
  99. 107Weak Cryptography Testingp.107
  100. 108WSTG-CRYP-01: Testing for Weak Transport Layer Securityp.108
    1. +5 more sections
  101. 109WSTG-CRYP-02: Testing for Padding Oraclep.109
    1. +5 more sections
  102. 110WSTG-CRYP-03: Testing for Sensitive Information Sent via Unencrypted Channelsp.110
    1. +6 more sections
  103. 111WSTG-CRYP-04: Testing for Weak Encryptionp.111
    1. +5 more sections
  104. 112Business Logic Testingp.112
  105. 113WSTG-BUSL-00: Introduction to Business Logicp.113
    1. +5 more sections
  106. 114WSTG-BUSL-01: Test Business Logic Data Validationp.114
    1. +7 more sections
  107. 115WSTG-BUSL-02: Test Ability to Forge Requestsp.115
    1. +7 more sections
  108. 116WSTG-BUSL-03: Test Integrity Checksp.116
    1. +7 more sections
  109. 117WSTG-BUSL-04: Test for Process Timingp.117
    1. +5 more sections
  110. 118WSTG-BUSL-05: Test Number of Times a Function Can Be Used Limitsp.118
    1. +6 more sections
  111. 119WSTG-BUSL-06: Testing for the Circumvention of Work Flowsp.119
    1. +6 more sections
  112. 120WSTG-BUSL-07: Test Defenses Against Application Misusep.120
    1. +6 more sections
  113. 121WSTG-BUSL-08: Test Upload of Unexpected File Typesp.121
    1. +6 more sections
  114. 122WSTG-BUSL-09: Test Upload of Malicious Filesp.122
    1. +15 more sections
  115. 123WSTG-BUSL-10: Test Payment Functionalityp.123
    1. +6 more sections
  116. 124Client-side Testingp.124
  117. 125WSTG-CLNT-01: Testing for DOM-Based Cross Site Scriptingp.125
    1. +5 more sections
  118. 126WSTG-CLNT-01.1: Testing for Self DOM Based Cross-Site Scriptingp.126
    1. +3 more sections
  119. 127WSTG-CLNT-02: Testing for JavaScript Executionp.127
    1. +3 more sections
  120. 128WSTG-CLNT-03: Testing for HTML Injectionp.128
    1. +3 more sections
  121. 129WSTG-CLNT-04: Testing for Client-side URL Redirectp.129
    1. +3 more sections
  122. 130WSTG-CLNT-05: Testing for CSS Injectionp.130
    1. +3 more sections
  123. 131WSTG-CLNT-06: Testing for Client-side Resource Manipulationp.131
    1. +3 more sections
  124. 132WSTG-CLNT-07: Testing Cross Origin Resource Sharingp.132
    1. +4 more sections
  125. 133WSTG-CLNT-08: Testing for Cross Site Flashingp.133
    1. +3 more sections
  126. 134WSTG-CLNT-09: Testing for Clickjackingp.134
    1. +4 more sections
  127. 135WSTG-CLNT-10: Testing WebSocketsp.135
    1. +5 more sections
  128. 136WSTG-CLNT-11: Testing Web Messagingp.136
    1. +3 more sections
  129. 137WSTG-CLNT-12: Testing Browser Storagep.137
    1. +5 more sections
  130. 138WSTG-CLNT-13: Testing for Cross Site Script Inclusionp.138
    1. +3 more sections
  131. 139WSTG-CLNT-14: Testing for Reverse Tabnabbingp.139
    1. +4 more sections
  132. 140WSTG-CLNT-15: Testing for Client-side Template Injectionp.140
    1. +5 more sections
  133. 141API Testingp.141
  134. 142WSTG-APIT-00: API Testing Overviewp.142
    1. +4 more sections
  135. 143WSTG-APIT-01: API Reconnaissancep.143
    1. +4 more sections
  136. 144WSTG-APIT-02: API Broken Object Level Authorizationp.144
    1. +7 more sections
  137. 145WSTG-APIT-99: Testing GraphQLp.145
    1. +6 more sections
  138. 146Reportingp.146
  139. 147Reportingp.147
    1. +6 more sections
  140. 148Vulnerability Naming Schemesp.148
    1. +5 more sections
  141. 149Appendixp.149
  142. 150Testing Tools Resourcep.150
    1. +7 more sections
  143. 151Suggested Readingp.151
    1. +5 more sections
  144. 152Fuzzingp.152
    1. +3 more sections
  145. 153Encoded Injectionp.153
    1. +4 more sections
  146. 154Historyp.154
    1. +7 more sections
  147. 155Leveraging Dev Toolsp.155
    1. +14 more sections