WSTG – Web Security Testing Guide

WSTG (Web Security Testing Guide) is a standardized methodology for testing the security of web applications, created by the OWASP WSTG initiative. It is intended to provide cybersecurity professionals with a comprehensive guide for testing all areas of a web application – from user inputs, through authentication, to cryptographic controls.

At Haxoris, we use OWASP WSTG as the primary reference for penetration testing of web applications. It helps ensure that nothing is overlooked – we test according to proven procedures that are continually updated to match evolving threats.

  • Covers more than 60 test cases ✅
  • Focuses on real-world exploitation scenarios ✅
  • Increases clients' confidence in the security of their applications ✅
OWASP WSTG Illustration - Web Application Security Testing Methodology

What’s Included in WSTG?

OWASP WSTG consists of various testing categories, including:

  • WSTG-INFO – Information gathering
  • WSTG-ATHN – Authentication testing
  • WSTG-AUTHZ – Authorization testing
  • WSTG-INPUT – Input validation and data manipulation
  • WSTG-CRYP – Cryptography and sensitive data storage
  • WSTG-BUSL – Business logic flaws
  • WSTG-CONF – Configuration and session management

These areas form the backbone of every high-quality penetration test based on WSTG.

Why Do We Use WSTG?

WSTG provides a consistent and objective methodology, making it an ideal framework for assessing web application security. We use it for:

  • Internal and external testing
  • Developing secure applications from the start
  • Compliance testing against standards (e.g., ISO, NIS2)

Secure your application – test with WSTG

Book Now