This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

Difference between revisions of "OWASP Testing Guide Table of Contents"

Jump to: navigation, search
(Manual testing techniques: Change section names to "how to".)
Line 40: Line 40:
#[[Business logic testing]] - <TBD>
#[[Business logic testing]] - <TBD>
#[[Authentication Testing Guide|Authentication]]
#[[Authentication Testing Guide|Authentication]]
#[[How to perform cookie manipulation test]]
#[[Cookie manipulation]]
#[[How to test for weak session tokens]]
#[[Weak session tokens]]
#[[How to perform session riding test]]
#[[Session riding test]]
#[[How to test for vulnerable remember password implementation]]#[[How to test for default or guessable user accounts and empty passwords]]
#[[Vulnerable remember password implementation]]
#[[How to test for application layer Denial of Service (DoS) attacks]]
#[[Default or guessable user accounts and empty passwords]]
#[[Application layer Denial of Service (DoS) attacks]]
#[[DoS: Locking Customer Accounts]]
#[[DoS: Locking Customer Accounts]]
#[[DoS: Buffer Overflows]]
#[[DoS: Buffer Overflows]]
Line 59: Line 60:
#[[Configuration Management Infrastructure]]
#[[Configuration Management Infrastructure]]
#[[Sensitive data in URL’s]]
#[[Sensitive data in URL’s]]
#[[SSL / TLS cipher specifications and requirements for site]]
#[[SSL / TLS cipher specifications and requirements for site]]
#[[How to Test]]
#[[Web Services Security Testing]]
#[[Testing Tools|Tools]]
#[[Testing Tools|Tools]]
#[[Web Services Security Testing]]
==[[The OWASP Testing Framework]]==
==[[The OWASP Testing Framework]]==

Revision as of 05:30, 28 July 2006


  1. Copyright and License
  2. Endorsements
  3. Trademarks


  1. Performing An Application Security Review
  2. Principles of Testing
  3. Testing Techniques Explained

Methodologies Used

  1. Secure application design
  2. Code Review (See the code review project)
    • Overview
    • Advantages and Disadvantages
  3. Penetration Testing
    • Overview
    • Advantages and Disadvantages
  4. The Need for a Balanced Approach
  5. A Note about Web Application Scanners
  6. A Note about Static Source Code Review Tools

Finding Specific Issues In a Non-Technical Manner

  1. Threat Modeling Introduction
  2. Design Reviews
  3. Threat Modeling the Application
  4. Policy Reviews
  5. Requirements Analysis
  6. Developer Interviews and Interaction

Finding Specific Vulnerabilities Using Source Code Review

For code review please see: The code review section has now got its own area.

Manual testing techniques

  1. Business logic testing - <TBD>
  2. Authentication
  3. Cookie manipulation
  4. Weak session tokens
  5. Session riding test
  6. Vulnerable remember password implementation
  7. Default or guessable user accounts and empty passwords
  8. Application layer Denial of Service (DoS) attacks
  9. DoS: Locking Customer Accounts
  10. DoS: Buffer Overflows
  11. DoS: User Specified Object Allocation
  12. DoS: User Input as a Loop Counter
  13. DoS: Writing User Provided Data to Disk
  14. DoS: Failure to Release Resources
  15. DoS: Storing too Much Data in Session
  16. Buffer Overflow
  17. Test and debug files
  18. File extensions handling
  19. Old, backup and unreferenced files
  20. Defense from Automatic Attacks
  21. Configuration Management Infrastructure
  22. Sensitive data in URL’s
  23. SSL / TLS cipher specifications and requirements for site
  24. Web Services Security Testing
  25. References
  26. Tools

The OWASP Testing Framework

  1. Overview
  2. Phase 1 — Before Development Begins
    • Phase 1A: Policies and Standards Review
    • Phase 1B: Develop Measurement and Metrics Criteria (Ensure Traceability)
  3. Phase 2: During Definition and Design
    • Phase 2A: Security Requirements Review
    • Phase 2B: Design an Architecture Review
    • Phase 2C: Create and Review UML Models
    • Phase 2D: Create and Review Threat Models
  4. Phase 3: During Development
    • Phase 3A: Code Walkthroughs
    • Phase 3B: Code Reviews
  5. Phase 4: During Deployment
    • Phase 4A: Application Penetration Testing
    • Phase 4B: Configuration Management Testing
  6. Phase 5: Maintenance and Operations
    • Phase 5A: Conduct Operational Management Reviews
    • Phase 5B: Conduct Periodic Health Checks
    • Phase 5C: Ensure Change Verification
  7. A Typical SDLC Testing Workflow
    • Figure 3: Typical SDLC Testing Workflow.

Appendix A: Testing Tools

  1. Source Code Analyzers
  2. Open Source / Freeware
    • Commercial
  3. Black Box Scanners
    • Open Source
    • Commercial
  4. Other Tools
    • Runtime Analysis
    • Binary Analysis
    • Requirements Management

Appendix B: Suggested Reading

  1. Whitepapers
  2. Books
  3. Articles
  4. Useful Websites
  5. OWASP —


  1. Figure 1: Proportion of Test Effort in SDLC.
  2. Figure 2: Proportion of Test Effort According to Test Technique.
  3. Figure 3: Typical SDLC Testing Workflow.