thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

OWASP Web Security Testing Guide (WSTG)

OWASP's comprehensive guide for testing the security of web applications and services, organized by test category with unique test IDs.

Definition

The WSTG provides a framework and detailed test cases for information gathering, configuration, identity, authentication, authorization, session management, input validation, error handling, cryptography, business logic and client-side testing. Each test has an identifier such as WSTG-INPV-05 for SQL injection. It complements the OWASP ASVS, which defines requirements rather than test procedures.

Example

A tester references WSTG-SESS-02 when checking cookie attributes during a web app assessment.

Exam tip

WSTG tells you how to test; ASVS tells you what security requirements to verify.

Related terms