Install OWASP PTK

Choose the correct browser extension

Interactive testing or automation runtime

The two extensions have deliberately different responsibilities. Install the full OWASP PTK for hands-on testing. Install PTK Auto only when an automation client such as PTK Agent will control it.

Full extension

OWASP Penetration Testing Kit

For interactive DAST, IAST, client-side SAST, SCA, traffic inspection, Request Builder, cookies, JWT testing and other manual pentesting workflows.

Chrome ChromeChrome Web Store Microsoft Edge Microsoft EdgeEdge Add-ons Firefox FirefoxFirefox Add-ons
First run: open or reload the application you are authorised to test after installation, then select the PTK icon. The extension will populate its dashboard from that live browser context.

Restricted automation runtime

PTK Auto

For automated tests, CLI workflows, CI/CD pipelines and supported browser-testing providers. PTK Auto is controlled by an authorised automation client and is not a replacement for the interactive extension.

Chrome PTK Auto for ChromeChrome Web Store Microsoft Edge PTK Auto for EdgeEdge Add-ons Firefox PTK Auto for FirefoxFirefox Add-ons

Install PTK Agent

The pentestkit npm package provides the CLI, framework integrations and browser runtime acquisition used for automation.

npm install -D pentestkit
npx ptk-agent --doctor-extension

Automation quick start

Run in GitHub Actions

Use the published PTK Action to run the same agent lifecycle in CI, retain scan artifacts and publish supported findings to code scanning.

View on GitHub Marketplace

Need help choosing?

Use OWASP PTK when a person is testing in the browser. Use PTK Auto with PTK Agent when code controls the browser. The OWASP ZAP add-on manages the full extension for its own controlled browser sessions.

Interactive guide Automation guide ZAP integration