OWASP Penetration Testing Kit - Release Notes

PTK 9.9.7 focuses on making ZAP-managed automation reliable enough for release, while reducing browser permissions and tightening callback-data handling. Release validation passed the Juice Shop smoke gate, the ZAP active-scan-rule Firing Range matrix, the ZAP legacy spiderClient Firing Range matrix, and the npm release matrix across packaged and installed flows.

PTK 9.9.5 focuses on stabilizing real browser automation and improving scanner accuracy. This release makes ZAP-managed Edge and Firefox scans more predictable, keeps unrelated manual tabs out of active scan scope, improves AngularJS and DOM taint coverage, fixes JWT carrier false positives, and adds stronger local Agent SDK/npm workflows for repeatable release validation.

PTK 9.9.0 focuses on more reliable automation and higher-signal DAST coverage. This release improves ZAP-managed browser automation startup, runtime selection, progress handling, and session coordination for Chrome, Edge, and Firefox validation workflows. It also adds safer direct Playwright/Codex scan automation, expands reflected XSS payload coverage across more browser contexts, adds OS command injection coverage, and reduces repeated SPA/DOM XSS and IAST noise through rulepack-driven aggregation. Export handling, redaction, automation telemetry, and automated scan performance have also been tightened.

PTK 9.8.0 focuses on making DAST easier to control and easier to review. This release adds opt-in autodiscovery with explicit budgets, clearer separation between user-driven and discovered requests, and a new Explorer workflow alongside improvements to the Analysis view. It also restores full HTTP evidence in DAST details, cleans up duplicate passive header checks, improves secure-header coverage, and makes the popup and dashboard faster and smoother to use day to day.

PTK 9.7.0 focuses on making scan results easier to act on. DAST now includes dedicated Analysis and Coverage views to highlight the most useful manual-testing candidates and show which engines contributed evidence for the same host/session. IAST and SAST now use bucketed summaries to group runtime and code-level results into practical attack surfaces and review areas, reducing noise and surfacing the most relevant information first. This release also improves export/import flow, R-Builder handoff, evidence presentation, cross-engine coverage, and overall stability and performance across the extension.

PTK 9.6.0 is a major reporting-focused release. It introduces PDF and Markdown exports with two presets: Executive reports for shareable, prioritised summaries, and Technical reports for deeper per-engine detail. This release adds a dedicated Summary section, severity-based triage filters, and confidence scoring with correlation across DAST, IAST, SAST and SCA to highlight high-signal issues. Exports are safe-by-default with redaction enabled, evidence is easier to consume thanks to truncation and consistent formatting, and Executive reports reduce noise by grouping repeated findings.

PTK 9.5.0 focuses on improving reliability and usability during real-world testing. JWT attacks now perform stricter validation and reduce noise by fixing false positives around alg=none and endpoints that are intentionally public. This release also improves DAST support for Single-Page Applications by handling SPA navigation and in-app flows more reliably. Finally, UI performance has been optimized so the dashboard feels faster and remains responsive under scanning load.

PTK 9.4.0 introduces CVE-focused passive checks through the new CVE Lookup module and expands coverage with 10 new CVEs available in both passive lookup and active DAST attacks. IAST was also enhanced using chrome.debugger to improve request/response visibility and correlation for modern applications. Finally, this release includes UI improvements and stability fixes to make day-to-day scanning smoother and more reliable.

This release unifies how DAST, SAST and IAST report findings, with a shared scan envelope, standardised metadata and a common normalizeScanResult view model across the UI. Modules and rules have been cleaned up with consistent descriptions, recommendations and OWASP/CWE mapping, while new DAST profiles give users better control over attack strategy and noise. React2Shell-powered CVE modules add coverage for modern React injection chains (including CVE-2025-55182 labs), and IAST gains more stable module loading plus JSON-driven sinks to reduce false positives. Finally, SCA results are now aligned with the same model and the portal schema is ready to surface SCA findings alongside DAST/SAST/IAST.

SAST now executes in a dedicated worker context (offscreen document on Chrome MV3, background worker on Firefox), so heavy JavaScript scans no longer freeze the UI and stay responsive even on large SPAs. New structured telemetry emits per-file and per-module progress, while upgraded taint traces and visualization make it easier to follow data flows end-to-end. The taint model has been refined with cleaner document.cookie handling and new rule filters to cut noise and keep reports focused on the most relevant issues.

DAST now runs attacks through a queued, rate-limited worker pool with request fingerprinting, deduplication and scoped DAST filters, so large scans stay reliable and focused even under throttling. SAST adds new rules, visual taint traces, self-contained report cards, and excludes well-known libraries like jQuery from analysis to cut false positives and highlight real issues in your own code.

DAST now targets each input parameter individually and reports exactly which parameter (name + original value) is vulnerable for easy triage. It also parses application/json bodies and tests keys/array elements/path locations structurally to find injections and logic flaws.

Since this version the OWASP PTK supports taint flow rules for SAST. DAST scan can be tuned with requests per second and concurrency.

Since this version the OWASP PTK supports Static Application Security Testing by analyzing every JavaScript, WebAssembly, and embedded script loaded by the page.

Since this version the OWASP PTK supports Interactive Application Security Testing by implementing hooks fir client-side JavaScript.