The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

文件	最后提交记录	最后更新时间
.github	Bump actions/cache from 6.0.0 to 6.1.0 in the dependencies group (#1437)	1 天前
.vscode	docs: add hop-by-hop header injection test case to WSTG-CONF-14 (#1310) * docs: add hop-by-hop header injection test case to WSTG-CONF-14 * Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md * Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md * Address linting issues * Remove misplaced bullet * Put list back together * Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update 14-Test_Other_HTTP_Security_Header_Misconfigurations.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Correct command example indent --------- Co-authored-by: Rick M <kingthorin@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	4 个月前
checklists	Publish Latest checklists 2026-06-30 (#1438) Updates based on OWASP/wstg@b87d2b2	1 天前
document	docs: add Mohammad Hossein Sadeghian to authors (#1439)	1 天前
template	Standardize merged test metadata using reference link marker (#1329)	4 个月前
.editorconfig	Replace .devcontainer with .vscode workspace config and .editorconfig (#1300) * Initial plan * Remove .devcontainer and add .vscode, .editorconfig, and lint script Co-authored-by: kingthorin <7570458+kingthorin@users.noreply.github.com> * Fix redundant lines in .gitignore Co-authored-by: kingthorin <7570458+kingthorin@users.noreply.github.com> * Move github.dev section above Codespaces section in CONTRIBUTING.md Co-authored-by: kingthorin <7570458+kingthorin@users.noreply.github.com> * Fix markdown linting errors in CONTRIBUTING.md - add blank lines around code blocks Co-authored-by: kingthorin <7570458+kingthorin@users.noreply.github.com> * Fix terminology in CONTRIBUTING.md - use proper product names Co-authored-by: kingthorin <7570458+kingthorin@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: kingthorin <7570458+kingthorin@users.noreply.github.com> Co-authored-by: Rick M <kingthorin@users.noreply.github.com>	4 个月前
.gitattributes	Tweak Resource Files (#769) Ensure *.nav files use LF not CRLF and are treated as other text based files Signed-off-by: kingthorin <kingthorin@users.noreply.github.com>	4 年前
.gitignore	Improve markdown lint PR comment formatting (#1311) * Initial plan * Improve markdown lint comment formatting for better readability Co-authored-by: kingthorin <7570458+kingthorin@users.noreply.github.com> * Fix: Use specific exception handling instead of bare except Co-authored-by: kingthorin <7570458+kingthorin@users.noreply.github.com> * Clean up: Remove test files and add to .gitignore Co-authored-by: kingthorin <7570458+kingthorin@users.noreply.github.com> * Refactor: Move Python script to .github/workflows/scripts directory Co-authored-by: kingthorin <7570458+kingthorin@users.noreply.github.com> * Update .gitignore with artifacts from all CI workflows Co-authored-by: kingthorin <7570458+kingthorin@users.noreply.github.com> * Refactor: Improve Python script modularity and type hints Co-authored-by: kingthorin <7570458+kingthorin@users.noreply.github.com> * Fix: Ensure accurate error count and clarify README usage Co-authored-by: kingthorin <7570458+kingthorin@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: kingthorin <7570458+kingthorin@users.noreply.github.com>	4 个月前
CODE_OF_CONDUCT.md	Fix markdown lint issues (#1045) * Fix markdown lint issues * More tweaks	3 年前
CONTRIBUTING.md	Tweak Textlint and Note wording/syntax (#1424) * Tweak Textlint and Note wording/syntax Signed-off-by: kingthorin <kingthorin@users.noreply.github.com>	24 天前
LICENSE	Add LICENSE Added CC-SA 4.0 license to the repo root. Note: https://github.com/OWASP/OWASP-Testing-Guide-v5/blob/master/document/1%20Frontispiece/1%20Frontispiece.md#copyright-and-licensee currently lists CC-SA 2.5, however, per agreement with the project leads we'll be moving to CC-SA 4.0 for v5 of the guide.	7 年前
README.md	Fix Spanish link in README.md (#1281)	5 个月前
REST_CS_Migrate.md	Tweak Textlint and Note wording/syntax (#1424) * Tweak Textlint and Note wording/syntax Signed-off-by: kingthorin <kingthorin@users.noreply.github.com>	24 天前
SECURITY.md	Markdown Lint Fixes (#1274) Fixes recent rule changes/additions. Signed-off-by: kingthorin <kingthorin@users.noreply.github.com>	5 个月前
Testing_for_APIs.md	Fix ZAP references (#1087) * Fix ZAP references Per: https://www.zaproxy.org/blog/2023-08-01-zap-is-joining-the-software-security-project/ Signed-off-by: kingthorin <kingthorin@users.noreply.github.com>	2 年前
style_guide.md	Tweak Textlint and Note wording/syntax (#1424) * Tweak Textlint and Note wording/syntax Signed-off-by: kingthorin <kingthorin@users.noreply.github.com>	24 天前

自动翻译

OWASP Web Security Testing Guide

欢迎来到开放全球应用安全项目®（OWASP®）Web安全测试指南（WSTG）的官方代码库。WSTG是一份全面的指南，旨在测试Web应用程序和Web服务的安全性。它由安全专业人士和热心志愿者共同协作创建，提供了一套最佳实践框架，为全球的渗透测试人员和组织所采用。

我们目前正在开发5.0版本。您可以在GitHub上阅读当前文档。

关于最新的稳定版本，请查看4.2版本。该版本也可在线上查阅。

如何引用WSTG测试场景
- 链接方式
贡献、功能请求与反馈
与我们交流
项目负责人
核心团队
翻译版本

How To Reference WSTG Scenarios

每个测试场景都有一个标识符，格式为WSTG-<category>-<number>，其中：“category”是一个4个字符的大写字符串，用于标识测试类型或弱点类型；“number”是一个从01到99的零填充数字值。例如：WSTG-INFO-02表示第二个信息收集测试。

这些标识符在不同版本之间可能会发生变化。因此，其他文档、报告或工具最好使用以下格式：WSTG-<version>-<category>-<number>，其中：“version”是去除标点符号的版本标签。例如：WSTG-v42-INFO-02明确表示版本4.2中的第二个信息收集测试。

如果使用标识符时未包含<version>元素，则应默认为指最新的Web安全测试指南内容。随着指南的不断发展和变化，这种做法可能会带来问题，因此作者或开发人员应包含版本元素。

链接方式

链接到 Web Security Testing Guide 的场景时，应使用带版本号的链接，而非 stable 或 latest，因为这些标签会随时间变化。项目团队的目标是确保版本化链接保持稳定不变。例如：https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/01-Information_Gathering/02-Fingerprint_Web_Server.html。注意：v42 表示版本 4.2。