[PDF] Testing Guide The Open Web Application Security

What is included in the OWASP testing guide?

For the purpose of the OWASP Testing Guide, only the security threats related to web applications will be considered and not threats to web servers (e.g., the infamous “%5c escape code” into Microsoft IIS web server). Further reading suggestions will be provided in the references section for interested readers.

What is OWASP and why is it important?

Our mission is to make application security “visible”, so that people and organizations can make informed decisions about application security risks. Every one is free to participate in OWASP and all of our materials are available under a free and open software license.

What is a penetration test in OWASP?

Phase 4.2: Configuration Management Testing The application penetration test should include the checking of how the infrastructure was deployed and secured. While the application may be secure, a small aspect of the configuration could still be at a default install stage and vulnerable to exploitation. The OWASP Testing Framework 26

What is OWASP AUTHN 001 authentication endpoint request?

OWASP- AUTHN-001 Authentication endpoint request should be HTTPS Ensure that users are only asked to submit authentication credentials on pages that are served with SSL. This ensures that the user knows who is asking for his / her credentials as well as where they are being sent.