Certified Web Application Pentester
Foundation & Lab Build Up 0/3 Conquering BurpSuite 0/1 Acquiring Dev Tools for Pentesting 0/1 Proxy Configuration & Interception 0/1 Introduction to OWASP Top 10 0/1 ▶ Web Security Testing Guide Framework 0/1 Essentials CLI Tools 0/1 Pentest Methodology and Workflow 0/1 Reconnaissance and Information Gathering 0/8 Enumeration & Mapping Bugs 0/10 Attacking Authentication Flow 0/1
← Certified Web Application Pentester

Web Security Testing Guide Framework

Task 1
WSTG Overview

1. OWASP Web Security Testing Guide (WSTG)

The WSTG provides a comprehensive framework for testing web application security. Version 4.2 contains 91 test cases organized into 12 categories.

2. Testing Categories

WSTG-INFO: Information Gathering

IDTest Name
WSTG-INFO-01Conduct Search Engine Discovery Recon
WSTG-INFO-02Fingerprint Web Server
WSTG-INFO-03Review Webserver Metafiles for Info Leakage
WSTG-INFO-04Enumerate Applications on Webserver
WSTG-INFO-05Review Webpage Content for Info Leakage
WSTG-INFO-06Identify Application Entry Points
WSTG-INFO-07Map Execution Paths Through Application
WSTG-INFO-08Fingerprint Web Application Framework
WSTG-INFO-09Fingerprint Web Application
WSTG-INFO-10Map Application Architecture

WSTG-CONF: Configuration and Deploy Management

IDTest Name
WSTG-CONF-01Test Network Infrastructure Configuration
WSTG-CONF-02Test Application Platform Configuration
WSTG-CONF-03Test File Extensions Handling
WSTG-CONF-04Review Old Backup and Unreferenced Files
WSTG-CONF-05Enumerate Infrastructure and Admin Interfaces
WSTG-CONF-06Test HTTP Methods
WSTG-CONF-07Test HTTP Strict Transport Security
WSTG-CONF-08Test RIA Cross Domain Policy
WSTG-CONF-09Test File Permission
WSTG-CONF-10Test for Subdomain Takeover
WSTG-CONF-11Test Cloud Storage

WSTG-IDNT: Identity Management

IDTest Name
WSTG-IDNT-01Test Role Definitions
WSTG-IDNT-02Test User Registration Process
WSTG-IDNT-03Test Account Provisioning Process
WSTG-IDNT-04Test for Account Enumeration
WSTG-IDNT-05Test for Weak or Unenforced Username Policy

WSTG-ATHN: Authentication Testing

IDTest Name
WSTG-ATHN-01Test for Credentials over Encrypted Channel
WSTG-ATHN-02Test for Default Credentials
WSTG-ATHN-03Test for Weak Lock Out Mechanism
WSTG-ATHN-04Test for Bypassing Authentication Schema
WSTG-ATHN-05Test for Vulnerable Remember Password
WSTG-ATHN-06Test for Browser Cache Weaknesses
WSTG-ATHN-07Test for Weak Password Policy
WSTG-ATHN-08Test for Weak Security Question/Answer
WSTG-ATHN-09Test for Weak Password Change/Reset
WSTG-ATHN-10Test for Weaker Auth in Alt Channel

WSTG-ATHZ: Authorization Testing

IDTest Name
WSTG-ATHZ-01Test Directory Traversal/File Include
WSTG-ATHZ-02Test for Bypassing Authorization Schema
WSTG-ATHZ-03Test for Privilege Escalation
WSTG-ATHZ-04Test for Insecure Direct Object References

WSTG-SESS: Session Management

IDTest Name
WSTG-SESS-01Test for Session Management Schema
WSTG-SESS-02Test for Cookies Attributes
WSTG-SESS-03Test for Session Fixation
WSTG-SESS-04Test for Exposed Session Variables
WSTG-SESS-05Test for CSRF
WSTG-SESS-06Test for Logout Functionality
WSTG-SESS-07Test Session Timeout
WSTG-SESS-08Test for Session Puzzling
WSTG-SESS-09Test for Session Hijacking

WSTG-INPV: Input Validation Testing

IDTest Name
WSTG-INPV-01Test for Reflected XSS
WSTG-INPV-02Test for Stored XSS
WSTG-INPV-03Test for HTTP Verb Tampering
WSTG-INPV-04Test for HTTP Parameter Pollution
WSTG-INPV-05Test for SQL Injection
WSTG-INPV-06Test for LDAP Injection
WSTG-INPV-07Test for XML Injection
WSTG-INPV-08Test for SSI Injection
WSTG-INPV-09Test for XPath Injection
WSTG-INPV-10Test for IMAP/SMTP Injection
WSTG-INPV-11Test for Code Injection
WSTG-INPV-12Test for Command Injection
WSTG-INPV-13Test for Format String Injection
WSTG-INPV-14Test for Incubated Vulnerability
WSTG-INPV-15Test for HTTP Splitting/Smuggling
WSTG-INPV-16Test for HTTP Incoming Requests
WSTG-INPV-17Test for Host Header Injection
WSTG-INPV-18Test for SSTI
WSTG-INPV-19Test for SSRF

WSTG-ERRH: Error Handling

IDTest Name
WSTG-ERRH-01Test for Improper Error Handling
WSTG-ERRH-02Test for Stack Traces

WSTG-CRYP: Cryptography

IDTest Name
WSTG-CRYP-01Test for Weak Transport Layer Security
WSTG-CRYP-02Test for Padding Oracle
WSTG-CRYP-03Test for Sensitive Info Sent via Unencrypted
WSTG-CRYP-04Test for Weak Encryption

WSTG-BUSL: Business Logic Testing

IDTest Name
WSTG-BUSL-01Test Business Logic Data Validation
WSTG-BUSL-02Test Ability to Forge Requests
WSTG-BUSL-03Test Integrity Checks
WSTG-BUSL-04Test for Process Timing
WSTG-BUSL-05Test Number of Times a Function Can Be Used
WSTG-BUSL-06Test for Circumvention of Work Flows
WSTG-BUSL-07Test Defenses Against Application Misuse
WSTG-BUSL-08Test Upload of Unexpected File Types
WSTG-BUSL-09Test Upload of Malicious Files

WSTG-CLNT: Client-Side Testing

IDTest Name
WSTG-CLNT-01Test for DOM-Based XSS
WSTG-CLNT-02Test for JavaScript Execution
WSTG-CLNT-03Test for HTML Injection
WSTG-CLNT-04Test for Client-Side URL Redirect
WSTG-CLNT-05Test for CSS Injection
WSTG-CLNT-06Test for Client-Side Resource Manipulation
WSTG-CLNT-07Test Cross Origin Resource Sharing
WSTG-CLNT-08Test for Cross Site Flashing
WSTG-CLNT-09Test for Clickjacking
WSTG-CLNT-10Test WebSockets
WSTG-CLNT-11Test Web Messaging
WSTG-CLNT-12Test Browser Storage
WSTG-CLNT-13Test for Cross Site Script Inclusion

3. Using WSTG as a Checklist

# Create a testing tracker spreadsheet:
# | WSTG ID | Test | Status | Notes | Evidence |
# |---------|------|--------|-------|----------|
# | INFO-01 | Search Engine Recon | Done | Found 3 subdomains | screenshot1.png |
# | INFO-02 | Fingerprint Server | Done | Nginx 1.18, PHP 7.4 | headers.txt |

# Work through each category systematically
# Mark status: Not Tested / In Progress / Pass / Fail / N/A
# Document evidence for every finding

4. Priority Order for Time-Limited Engagements

  1. WSTG-ATHN: Authentication (high-impact findings)
  2. WSTG-ATHZ: Authorization (IDOR, privilege escalation)
  3. WSTG-INPV: Input Validation (injection attacks)
  4. WSTG-SESS: Session Management (session attacks)
  5. WSTG-BUSL: Business Logic (unique to each application)
  6. WSTG-CONF: Configuration (quick wins)
  7. WSTG-INFO: Information Gathering (foundation)
  8. WSTG-CLNT: Client-Side (XSS, clickjacking)
  9. WSTG-CRYP: Cryptography (SSL/TLS, hashing)
  10. WSTG-ERRH: Error Handling (information disclosure)