[PDF] Testing Guide 4 - OWASP Foundation

What is included in the OWASP testing guide?

For the purpose of the OWASP Testing Guide, only the security threats related to web applications will be considered and not threats to web servers (e.g., the infamous “%5c escape code” into Microsoft IIS web server). Further reading suggestions will be provided in the references section for interested readers.

What is a penetration test in OWASP?

Phase 4.2: Configuration Management Testing The application penetration test should include the checking of how the infrastructure was deployed and secured. While the application may be secure, a small aspect of the configuration could still be at a default install stage and vulnerable to exploitation. The OWASP Testing Framework 26

How can OWASP test for anti-automation?

OWASP Testing Guide 4.0: Business Logic Testing OWASP Cheat Sheet Anti-automation can be achieved in many ways, including the use of OWASP AppSensor and OWASP OWASP AppSensor can also help with Attack Detection and Response. OWASP Cornucopia Untrusted file data should be handled accordingly and in a secure manner.

What is OWASP Level 1?

Figure 1 - OWASP Application Security Verification Standard 4.0 Levels Level 1 is the only level that is completely penetration testable using humans. All others require access to documentation, source code, configuration, and the people involved in the development process.