Skip to content

README.md

Latest commit

 

History

History
85 lines (67 loc) · 4.67 KB

README.md

File metadata and controls

85 lines (67 loc) · 4.67 KB
Raw

OWASP PTK Pentester Guide

This guide is the practical entry point for pentesters using OWASP Penetration Testing Kit (PTK). It explains what PTK does, how to set it up, how to run browser-based DAST/IAST/SAST/SCA checks, how to use the manual tools, and how to turn results into useful evidence.

Who This Is For

  • Penetration testers and red teamers
  • Bug bounty hunters
  • AppSec engineers validating fixes
  • Developers and QA engineers adding security checks to browser workflows
  • Automation engineers running PTK from npm, Playwright, Selenium, Cypress, CI, or OWASP ZAP

Safe-Use Rules

Use PTK only against systems where you have explicit authorization. Active scans, request tampering, JWT manipulation, request smuggling research, and automated crawls can change application state, trigger monitoring, or generate load.

Before testing, confirm:

  • exact target domains and out-of-scope systems
  • allowed user roles and test accounts
  • testing windows and rate limits
  • whether destructive or state-changing actions are allowed
  • what evidence may be stored, shared, or exported

Recommended defaults:

Area Default
Browser profile Use a dedicated PTK testing profile
Accounts Use test accounts, not personal or production accounts
Scope Keep a written in-scope domain/path list
Rate Start with low request rate and low concurrency
Destructive actions Disable unless explicitly authorized
Secrets Use environment variables or CI secrets
Evidence Redact tokens, cookies, passwords, and personal data
Artifacts Do not commit browser profiles, cookies, traces, or scan exports

Guide Map

Page Use It For
Concepts PTK architecture, browser context, DAST/IAST/SAST/SCA, and engine selection
Installation Browser stores, source builds, npm automation, ZAP add-on, and first-run checks
Pentest Workflow A practical engagement flow from setup to recon, active testing, triage, and retest
Scanning Engines How to run and triage DAST, IAST, SAST, and SCA
Manual Tools Proxy, traffic log, R-Builder, JWT Inspector, cookies, storage, request smuggling, and utilities
Reporting Evidence collection, triage rules, report structure, and templates
Automation and ZAP npm/CLI usage, scenarios, CI, PTK Agent, SDKs, and OWASP ZAP integration
Troubleshooting Common setup, bridge, export, auth, scenario, active scan, and ZAP issues

Fast Path

  1. Install PTK in a dedicated browser profile.
  2. Open the authorized target and sign in with a test account.
  3. Browse the main workflows manually: login, search, profile, basket/order, account settings, upload, admin, or role-specific flows.
  4. Open PTK and review Dashboard, Proxy, cookies/storage, technologies, headers, and crawled links.
  5. Run a bounded DAST scan on important pages or selected requests.
  6. Enable IAST while exercising SPA and JavaScript-heavy workflows.
  7. Run SAST on loaded scripts to find client-side sources, sinks, hidden routes, and risky JavaScript.
  8. Run SCA to identify vulnerable client-side libraries.
  9. Send interesting requests to R-Builder for manual tampering.
  10. Export findings and write reports with reproducible steps, impact, evidence, and remediation.

Learning Path

These videos are the approved current learning references for this guide:

Topic Video
Starter workflow 3 easy steps to start your bug bounty
PTK 9.8 workflow OWASP PTK 9 8 0
SAST / DOM XSS OWASP PTK SAST catches a DOM-based XSS vulnerability on PortSwigger's lab
JWT testing How to solve JWT PortSwigger labs using OWASP PTK
ZAP integration OWASP PTK + ZAP
Automation and Codex workflow OWASP PTK and Codex
Request smuggling OWASP PTK #8 4 3 request smuggling

Primary References