# OWASP Penetration Testing Kit

> OWASP Penetration Testing Kit (PTK) is an open-source browser security platform for testing authenticated web applications and SPAs with DAST, client-side SAST, in-browser IAST, SCA, traffic inspection, request replay and JWT testing.

The interactive OWASP PTK extension is for hands-on browser testing. PTK Auto is a restricted browser runtime controlled by PTK Agent. PTK Agent is published as the `pentestkit` npm package and provides CLI, test-framework, CI/CD and supported browser-provider orchestration. PTK Action packages that workflow for GitHub Actions. The OWASP ZAP add-on integrates ZAP with the full OWASP PTK extension.

Use PTK only on applications you own or are explicitly authorised to test. The source repositories and their versioned documentation are authoritative for implementation-specific options.

## Products

- [OWASP PTK website](https://pentestkit.co.uk/): Product overview and security capabilities.
- [Install OWASP PTK or PTK Auto](https://pentestkit.co.uk/install.html): Distinct Chrome, Microsoft Edge and Firefox store links for the interactive and automation extensions.
- [PTK automation overview](https://pentestkit.co.uk/automation.html): Product boundary and supported quick starts.
- [pentestkit on npm](https://www.npmjs.com/package/pentestkit): Published PTK Agent package.
- [PTK Agent source](https://github.com/ptklabs/ptk-agent): CLI, framework and provider implementation.
- [PTK Action](https://github.com/marketplace/actions/owasp-ptk-security-scan): Published GitHub Action.
- [OWASP ZAP integration](https://www.zaproxy.org/docs/desktop/addons/owasp-ptk/): ZAP add-on documentation.

## Documentation

- [Interactive pentester guide](https://pentestkit.co.uk/howto.html): DAST, IAST, SAST, SCA and manual browser tools.
- [Full OWASP PTK pentester guide](https://github.com/DenisPodgurskii/pentestkit/tree/master/docs/guide): Versioned reference documentation maintained with the extension source.
- [PTK Agent documentation](https://github.com/ptklabs/ptk-agent/blob/main/docs/npm/README.md): Current CLI, framework, artifact and provider guidance.
- [Provider and browser matrix](https://github.com/ptklabs/ptk-agent/blob/main/docs/npm/provider-browser-matrix.md): Tested automation compatibility.
- [PTK Action documentation](https://github.com/ptklabs/ptk-action): Workflow inputs, outputs, artifacts and SARIF guidance.
- [Release notes](https://pentestkit.co.uk/release_notes.html): OWASP PTK extension release history.
- [JWT security reference](https://pentestkit.co.uk/jwt.html): JSON Web Token attacks and mitigations.
- [OWASP Top 10, SANS Top 25 and MITRE CWE mapping](https://pentestkit.co.uk/owaspcwe.html): Filterable crosswalk from OWASP Top 10 2021 risks to related CWE entries.

## Source and project

- [OWASP project page](https://owasp.org/www-project-penetration-testing-kit/): Official OWASP project overview.
- [OWASP PTK extension source](https://github.com/DenisPodgurskii/pentestkit): Interactive and automation extension source.
- [PTK Agent source and issues](https://github.com/ptklabs/ptk-agent): npm package source and support.
- [PTK Action source and issues](https://github.com/ptklabs/ptk-action): GitHub Action source and support.
- [Browser security playground](https://ptklabs.github.io/ptk-playground/): Reproducible browser-security campaigns, paired controls and scanner targets.
- [Athena OS browser pentesting resources](https://athenaos.org/en/resources/browser-pentesting/): Athena OS lists OWASP PTK among its integrated browser add-ons.