Interactive testing
OWASP PTK
The full browser extension for DAST, IAST, client-side SAST, SCA, traffic inspection, Request Builder, JWT testing and other manual workflows.
One security platform, several workflows
Choose how you use PTK
Use the interactive extension for hands-on testing, or connect the restricted automation runtime to your tests and delivery pipelines.
Browser runtime
PTK Auto
A restricted browser-side security runtime controlled by an authorised automation session. It has no manual scan controls or API-key fields.
CLI and test frameworks
PTK Agent
The pentestkit npm package orchestrates PTK Auto from CLI, Playwright,
Puppeteer, Selenium and Cypress workflows.
CI/CD
PTK Action
Run PTK security checks in GitHub Actions, publish artifacts and SARIF, and apply a configurable severity gate.
Test infrastructure
Browser providers
Run PTK Agent with supported local and remote browser providers while keeping the same PTK scan lifecycle and findings contract.
Integration
OWASP ZAP
Combine ZAP scanning with PTK browser evidence. The ZAP add-on uses the full OWASP PTK extension in controlled browser sessions.
Learn OWASP PTK
Choose the guide that fits your task
Start with the visual walkthrough, then use the versioned reference when you need complete engine and workflow details.
Quick introduction
Website guide
Installation, interface orientation and common DAST, IAST, SAST, SCA, Request
Builder, cookie and JWT workflows.
Explore the visual guide
Complete reference
Full pentester guide
Detailed, versioned documentation maintained with the extension source for deeper
testing and configuration.
Open the full guide
Security capabilities
Test the application the browser actually sees
PTK combines active attacks, browser instrumentation, client-side analysis and manual testing tools in the authenticated application context.
DAST
Attack live requests and parameters for injection and other server-side weaknesses.
IAST
Trace sources, sinks and browser execution while the application runs.
Client-side SAST
Analyse inline and external JavaScript for unsafe patterns and taint flows.
SCA
Identify client-side components and known vulnerable versions.
Request Builder
Edit, replay and scan individual HTTP requests from the browser session.
JWT testing
Discover, inspect, modify and test JSON Web Tokens used by the application.
Traffic inspection
Capture HTTP(S) traffic and move relevant requests into Request Builder.
Cookie tools
Inspect, edit, remove and protect cookies used in the active browser session.
Security reference
OWASP Top 10, SANS Top 25 and MITRE CWE mapping
Explore the relationship between OWASP Top 10 2021 risks and the corresponding SANS and MITRE Common Weakness Enumeration entries. Filter the crosswalk to focus on SANS Top 25 or MITRE CWE Top 25 weaknesses.
Start here
Interactive or automated
Install OWASP PTK for hands-on testing. For repeatable tests, install PTK Agent and let it acquire and control the matching PTK Auto runtime.
PTK Agent quick start
npm install -D pentestkit
npx playwright install chromium
npx ptk-agent --doctor-extension
npx ptk-scan https://your-authorised-target.example \
--engine DAST,IAST,SAST,SCA \
--require-ptk-bridge \
--require-ptk-findings-export \
--wait-for-ptk-completeOpen source and built for authorised testing
Explore the OWASP project, contribute on GitHub, try the browser security test cases, or support continued development.
Security distribution
OWASP PTK is available in Athena OS
Athena OS includes OWASP Penetration Testing Kit among the browser add-ons integrated for web penetration-testing workflows.