OWASP Web Security Testing Guide

Source identity:

ddx:
  id: resource.owasp-wstg
  authoring:
    home: repo

OWASP Web Security Testing Guide

Source

URL: https://owasp.org/www-project-web-security-testing-guide/
Accessed: 2026-05-12

Summary

OWASP describes the Web Security Testing Guide as a comprehensive guide for testing web applications and web services. It provides a security testing framework, domain-specific test areas, and stable scenario identifiers that can be referenced from plans, reports, and tools.

Relevant Findings

WSTG covers domains such as configuration, identity, authentication, authorization, session management, input validation, error handling, cryptography, business logic, client-side behavior, and APIs.
Test scenarios include objectives, how to test, remediation guidance, tools, and references.
Versioned scenario identifiers help teams trace security tests to stable external guidance.
OWASP Developer Guide guidance says teams should tailor WSTG coverage to project needs instead of running every test by default.

HELIX Usage

This resource informs the Security Tests artifact. HELIX uses it to keep security verification concrete, traceable, and selected according to the project’s actual threat model and security requirements.

Authority Boundary

This resource supports web and API security testing. It does not replace project-specific threat modeling, legal/compliance review, penetration testing scope approval, or production monitoring.

Innsigle seal: model-primary by HELIX

The signature covers the markdown source of this page, not these HTML bytes. This page quotes that seal; verify it against the source file.

Composition: model-primary
Issuer: HELIX helix
Signing key: ed25519:b0865d76d834a52c48506414d16f4e5a (build key)
Signed source: research/owasp-wstg.md
Signed: 2026-09-23T14:11:58Z
Content digest: sha256:bf733f81…4a47ae62

This build key is endorsed by the human key for build signing; the signature is not a detector and not a truth guarantee.

Raw attestation JSON

{
  "payload": {
    "innsigle": "1",
    "type": "https://innsigle.dev/claim/colophon/v1",
    "issued_at": "2026-09-23T14:11:58Z",
    "issuer": {
      "id": "helix",
      "name": "HELIX",
      "key_id": "ed25519:b0865d76d834a52c48506414d16f4e5a",
      "key_url": "https://documentdrivendx.github.io/helix/.well-known/innsigle/keys.json"
    },
    "subjects": [
      {
        "uri": "https://documentdrivendx.github.io/helix/research/owasp-wstg/",
        "digest": {
          "alg": "sha256",
          "value": "bf733f81f89dbb70140ff4843f0ac3d3a781793aaae0b50eac419bbc4a47ae62"
        }
      }
    ],
    "colophon": {
      "schema_version": "1",
      "composition": "model-primary",
      "ingredients": [
        {
          "kind": "model",
          "name": "Claude",
          "role": "draft"
        },
        {
          "kind": "tool",
          "name": "sloptimizer",
          "role": "rewrite"
        },
        {
          "kind": "human",
          "name": "operator",
          "role": "structure-edit"
        }
      ],
      "notes": null
    }
  },
  "payload_encoding": "json",
  "signatures": [
    {
      "key_id": "ed25519:b0865d76d834a52c48506414d16f4e5a",
      "alg": "ed25519",
      "sig": "Xj2Kx5W1FSkcWtweRSaoc3C1YVpPRrP9ohVu9cN5J_pG7-quUwaf5pxJIjjDf-Fcvk3eOzJyoYqVikugUXZsCw",
      "signed_at": "2026-09-23T14:11:58Z"
    }
  ]
}

attestation file · issuer keys