OWASP Penetration Testing Kit

Dynamic Application Security Testing at runtime. Identify SQL injection, command injection, reflected/stored XSS

Interactive Application Security Testing instruments your app at runtime - right in the browser - tracking taint flows and code execution

Static Code Analysis for inline and external scripts flags unsafe patterns like `eval()`, `innerHTML` / `outerHTML` injection

Find outdated or vulnerable packages

Tamper any requests and/or run DAST attacks against a particular request

Capture all HTTP(S) traffic, replay requests in R-Builder

Analyze, craft, and tamper with JSON Web Tokens.

One-click visibility into tech stacks, WAFs, security headers, crawled links, and authentication flows

Add, edit, remove cookies or create rules to block and protect them

Add the PTK to browser automation systems like Selenium to get security insight while running tests

Macro and Traffic recording

API security testing with Swagger Editor, encode and decode with Decoder, use cheat sheets for XSS and SQL attacks