Cyver core supports the OWASP Web Security Testing Guide (WSTG) Checklist, specifically Version 4.2.
The OWASP WSTG is the comprehensive and authoritative guide for executing web application security testing and penetration testing. It provides the methodology and detailed, practical test cases that security professionals use globally.
General Information on the OWASP WSTG
The OWASP Web Security Testing Guide (WSTG) offers the globally recognized standard for web application security analysis.
What is the WSTG?
The WSTG serves as the essential reference manual, providing:
- Framework: It defines the security testing phases integrated across the entire Software Development Lifecycle (SDLC), from pre-development to maintenance.
- Methodology: It details the processes, techniques, and tools used during security analysis.
- Test Cases: It contains an exhaustive, categorical breakdown of specific tests required to verify the security of web applications and web services.
The guide ensures security analysis is rigorous, repeatable, and complete by covering every major category of the web application attack surface.
Core Testing Categories
The WSTG organizes its detailed security testing chapters into logical categories that cover the entire web application attack surface.
| WSTG Section | Example Tests |
|---|---|
| Information Gathering (4.1) | Search Engine Discovery, Fingerprint Web Server, Identify Application Entry Points. |
| Configuration and Deployment Management Testing (4.2) | Test Network Infrastructure Configuration, Test HTTP Strict Transport Security, Test File Permission. |
| Identity Management Testing (4.3) | Test Role Definitions, Testing for Account Enumeration and Guessable User Account. |
| Authentication Testing (4.4) | Testing for Weak Lock Out Mechanism, Testing for Weak Password Policy, Bypassing Authentication Schema. |
| Authorization Testing (4.5) | Testing for Bypassing Authorization Schema, Testing for Privilege Escalation, Insecure Direct Object References. |
| Session Management Testing (4.6) | Testing for Cookies Attributes, Testing for Cross Site Request Forgery (CSRF), Testing Session Timeout. |
| Input Validation Testing (4.7) | Testing for SQL Injection, Cross Site Scripting (XSS), Command Injection, Server-Side Request Forgery (SSRF). |
| Testing for Error Handling (4.8) | Testing for Improper Error Handling, Testing for Stack Traces. |
| Testing for Weak Cryptography (4.9) | Testing for Weak Transport Layer Security, Testing for Sensitive Information Sent via Unencrypted Channels. |
| Business Logic Testing (4.10) | Test Ability to Forge Requests, Test Number of Times a Function Can Be Used Limits, Testing for the Circumvention of Work Flows. |
| Client-side Testing (4.11) | Testing for DOM-Based XSS, Testing for Clickjacking, Testing WebSockets. |
| API Testing (4.12) | Testing GraphQL. |
Download
You can directly download the latest OWASP WSTG Checklist from our GitHub repository: