What to test across the web application attack surface, organised by area. Expand an area to see the checks and what a finding looks like.
A methodology reference from recon and authentication through input validation, logic and APIs. It tells you what to test, not how to weaponise it.
Common tooling: Burp Suite, OWASP ZAP, nmap, ffuf or gobuster, nikto and the browser developer tools, used within an authorised scope.
Structured around the OWASP Web Security Testing Guide methodology. Checks written in our own words.
Free for learners. Tell us who you are once and every tool opens after that. It helps us keep the tools working and build what you actually need.
One time only. We never sell your data.
