OWASP Projects and Application Security

OWASP Testing and Assessment Guides

5.1.

Web Security Testing Guide

5.1.1.

Testing Framework Fundamentals

5.1.1.1.

Testing Methodology Overview

5.1.1.2.

Test Planning and Preparation

5.1.1.3.

Test Execution Guidelines

5.1.1.4.

Results Documentation

5.1.2.

Information Gathering

5.1.2.1.

Conduct Search Engine Discovery

5.1.2.2.

Fingerprint Web Server

5.1.2.3.

Review Webserver Metafiles

5.1.2.4.

Enumerate Applications on Webserver

5.1.2.5.

Review Webpage Comments and Metadata

5.1.2.6.

Identify Application Entry Points

5.1.2.7.

Map Execution Paths Through Application

5.1.2.8.

Fingerprint Web Application Framework

5.1.2.9.

Fingerprint Web Application

5.1.2.10.

Map Application Architecture

5.1.3.

Configuration and Deployment Management Testing

5.1.3.1.

Test Network Infrastructure Configuration

5.1.3.2.

Test Application Platform Configuration

5.1.3.3.

Test File Extensions Handling

5.1.3.4.

Review Old Backup and Unreferenced Files

5.1.3.5.

Enumerate Infrastructure and Application Admin Interfaces

5.1.3.6.

Test HTTP Methods

5.1.3.7.

Test HTTP Strict Transport Security

5.1.3.8.

Test RIA Cross Domain Policy

5.1.3.9.

Test File Permission

5.1.3.10.

Test for Subdomain Takeover

5.1.3.11.

Test Cloud Storage

5.1.4.

Identity Management Testing

5.1.4.1.

Test Role Definitions

5.1.4.2.

Test User Registration Process

5.1.4.3.

Test Account Provisioning Process

5.1.4.4.

Test Account Enumeration and Guessable User Account

5.1.4.5.

Test Weak or Unenforced Username Policy

5.1.5.

Authentication Testing

5.1.5.1.

Test for Credentials Transported over Encrypted Channel

5.1.5.2.

Test for Default Credentials

5.1.5.3.

Test for Weak Lock Out Mechanism

5.1.5.4.

Test for Bypassing Authentication Schema

5.1.5.5.

Test for Vulnerable Remember Password

5.1.5.6.

Test for Browser Cache Weaknesses

5.1.5.7.

Test for Weak Password Policy

5.1.5.8.

Test for Weak Security Question Answer

5.1.5.9.

Test for Weak Password Change or Reset Functionalities

5.1.5.10.

Test for Weaker Authentication in Alternative Channel

5.1.6.

Authorization Testing

5.1.6.1.

Test Directory Traversal File Include

5.1.6.2.

Test for Bypassing Authorization Schema

5.1.6.3.

Test for Privilege Escalation

5.1.6.4.

Test for Insecure Direct Object References

5.1.7.

Session Management Testing

5.1.7.1.

Test for Session Management Schema

5.1.7.2.

Test for Cookies Attributes

5.1.7.3.

Test for Session Fixation

5.1.7.4.

Test for Exposed Session Variables

5.1.7.5.

Test for Cross Site Request Forgery

5.1.7.6.

Test for Logout Functionality

5.1.7.7.

Test Session Timeout

5.1.7.8.

Test for Session Puzzling

5.1.7.9.

Test for Session Hijacking

5.1.8.

Input Validation Testing

5.1.8.1.

Test for Reflected Cross Site Scripting

5.1.8.2.

Test for Stored Cross Site Scripting

5.1.8.3.

Test for HTTP Verb Tampering

5.1.8.4.

Test for HTTP Parameter Pollution

5.1.8.5.

Test for SQL Injection

5.1.8.6.

Test for LDAP Injection

5.1.8.7.

Test for XML Injection

5.1.8.8.

Test for SSI Injection

5.1.8.9.

Test for XPath Injection

5.1.8.10.

Test for IMAP SMTP Injection

5.1.8.11.

Test for Code Injection

5.1.8.12.

Test for Command Injection

5.1.8.13.

Test for Format String Injection

5.1.8.14.

Test for Incubated Vulnerability

5.1.8.15.

Test for HTTP Splitting Smuggling

5.1.8.16.

Test for HTTP Incoming Requests

5.1.8.17.

Test for Host Header Injection

5.1.8.18.

Test for Server Side Template Injection

5.1.9.

Error Handling Testing

5.1.9.1.

Test for Improper Error Handling

5.1.9.2.

Test for Stack Traces

5.1.10.

Cryptography Testing

5.1.10.1.

Test for Weak Transport Layer Security

5.1.10.2.

Test for Padding Oracle

5.1.10.3.

Test for Sensitive Information Sent via Unencrypted Channels

5.1.10.4.

Test for Weak Encryption

5.1.11.

Business Logic Testing

5.1.11.1.

Test Business Logic Data Validation

5.1.11.2.

Test for Forged Requests

5.1.11.3.

Test for Integrity Checks

5.1.11.4.

Test for Process Timing

5.1.11.5.

Test Number of Times a Function Can Be Used Limits

5.1.11.6.

Test for Circumvention of Work Flows

5.1.11.7.

Test Defenses Against Application Misuse

5.1.11.8.

Test for Upload of Unexpected File Types

5.1.11.9.

Test for Upload of Malicious Files

5.1.12.

Client-Side Testing

5.1.12.1.

Test for DOM Based Cross Site Scripting

5.1.12.2.

Test for JavaScript Execution

5.1.12.3.

Test for HTML Injection

5.1.12.4.

Test for Client Side URL Redirect

5.1.12.5.

Test for CSS Injection

5.1.12.6.

Test for Client Side Resource Manipulation

5.1.12.7.

Test Cross Origin Resource Sharing

5.1.12.8.

Test for Cross Site Flashing

5.1.12.9.

Test for Clickjacking

5.1.12.10.

Test WebSockets

5.1.12.11.

Test Web Messaging

5.1.12.12.

Test Browser Storage

5.1.12.13.

Test for Cross Site Script Inclusion

5.2.

Mobile Application Security Testing Guide

5.2.1.

Mobile Security Testing Fundamentals

5.2.1.1.

Mobile Application Security Model

5.2.1.2.

Mobile Application Taxonomies

5.2.1.3.

Mobile Application Security Testing

5.2.2.

General Mobile Application Testing Guide

5.2.2.1.

Mobile Application Security Testing

5.2.2.2.

Tampering and Reverse Engineering

5.2.2.3.

Testing Code Quality

5.2.2.4.

Testing Cryptography

5.2.2.5.

Testing Authentication and Session Management

5.2.2.6.

Testing Network Communication

5.2.2.7.

Testing Platform Interaction

5.2.2.8.

Testing User Privacy Protection

5.2.3.

Android Testing Guide

5.2.3.1.

Platform Overview

5.2.3.2.

Android Security Testing Basics

5.2.3.3.

Data Storage on Android

5.2.3.4.

Android Cryptographic APIs

5.2.3.5.

Local Authentication on Android

5.2.3.6.

Android Network Communication

5.2.3.7.

Android Platform APIs

5.2.3.8.

Code Quality and Build Settings for Android Apps

5.2.3.9.

Tampering and Reverse Engineering on Android

5.2.3.10.

Android Anti-Reversing Defenses

5.2.4.

iOS Testing Guide

5.2.4.1.

Platform Overview

5.2.4.2.

iOS Security Testing Basics

5.2.4.3.

Data Storage on iOS

5.2.4.4.

iOS Cryptographic APIs

5.2.4.5.

Local Authentication on iOS

5.2.4.6.

iOS Network Communication

5.2.4.7.

iOS Platform APIs

5.2.4.8.

Code Quality and Build Settings for iOS Apps

5.2.4.9.

Tampering and Reverse Engineering on iOS

5.2.4.10.

iOS Anti-Reversing Defenses

5.3.

API Security Testing Guide

5.3.1.

API Security Fundamentals

5.3.1.1.

API Security Landscape

5.3.1.2.

Common API Vulnerabilities

5.3.1.3.

API Testing Methodology

5.3.2.

REST API Security Testing

5.3.2.1.

Authentication Testing

5.3.2.2.

Authorization Testing

5.3.2.3.

Input Validation Testing

5.3.2.4.

Error Handling Testing

5.3.3.

GraphQL API Security Testing

5.3.3.1.

Query Complexity Analysis

5.3.3.2.

Authorization Testing

5.3.3.3.

Information Disclosure Testing

5.3.4.

SOAP API Security Testing

5.3.4.1.

XML Security Testing

5.3.4.2.

WS-Security Testing

5.3.4.3.

Schema Validation Testing

4. OWASP Software Assurance Maturity Model

Go to top

6. OWASP Security Tools and Utilities