>> The OWASP Web Security Testing Guide or WSTG.
Our learning objectives are to identify why
the WSTG is important when conducting
web application security testing and recognize
how the OWASP Top 10 and WSTG intersect.
A little bit of history,
as you can tell, I like history.
>> I think it's important.
>> I think it's important to see how these things develop,
how the OWASP Top 10 develops,
how the WSTG develops.
But obviously, both of these documents
have been around for a while,
the WSTG being around for almost 20 years.
But it was first released in 2004.
OWASP started in 2001.
A few years later they come out with the first version
of the web security testing guide.
That's gone through other iterations,
1.1, 2.0,
all the way up to 4.2,
4.2 being released in
December of 2020, so relatively recently.
They're also developing version 5.0.
The cool thing is when things
are being developed, this fifth version,
you can actually see what's being developed in "Real
time" It's on the OWASP website
to stable version being 4.2,
meaning we're not going to change anything.
You can see what's going on with
Version 5 on the OS website,
but just keep in mind that the content may change.
As you can see here, it says,
"The content may change frequently."
I typically go to
4.2 just because I know that it's stable.
If I'm interested in just looking at what might be new,
maybe some new attack
vectors or new ways to test something.
I'll look at version 5.0.
Layout, we have the introduction which goes over
the prerequisites of testing
and scope of as a penetration tester,
you should always know what your scope is.
Then we talk about the OS testing framework
and talks a little bit about
the software development lifecycle.
As you can see, OWASP likes to do a lot,
not just pen testing,
but also software development as well.
It's geared towards both as we talked about,
penetration testers,
but also software developers as well.
SLDC being a huge component of software development.
As pen testers, we should also be involved with
testing in nearly all aspects of the SLDC.
Web application security testing,
part of the WSTG
is we're going to spend the majority of our time.
This is the meat and potatoes.
This is where we see how to test for
particular types of vulnerabilities.
Reporting. That may be
very different depending on where you work.
If you're a consultancy,
if you work for an internal pen testing team,
you're reporting may be vastly different.
There may be different
ways that you want to report things.
There may be different requirements
depending on your vertical
that you have to report things.
But the WSTG has some information on reporting generally.
The appendix, don't skip the appendix.
There is some gold, there's
some great information in the appendix of the WSTG.
In the WSTG scenarios are referenced by their identifier.
Version, in some cases,
as you can see in this image,
it doesn't have the version.
Maybe like 4.2,
the category and then the number.
This has had a test HTTP methods and WSTG 0,
6, so category and number without the version.
Who uses the WSTG?
In the bug bounty world I've used this a lot.
In particular, companies, they may require that you
use or ask that you use
the WSTG in your testing methodology.
Obviously bug bounty hunters and
penetration testers being one and the same in many,
many respects,
being somewhat different in other respects.
But when looking at the WSTG,
if we're testing web application,
if I'm a pen tester or a bug bounty hunter,
I'm very interested in ways of testing that.
More formulaic for penetration testing,
I'm going to have to deliver a report to a customer.
I can definitely reference the WSTG as something,
as a tool or you are utility that I
used in my testing methodology.
Developers can also use this as
well developed some developers that I've met are
very interested in the web application security space
and when to test their own applications.
Developers want to understand
how these vulnerabilities come about,
how we as penetration testers or
bug bounty hunters, attack web applications.
Developers are interested in this as well.
We'll read the WSTG.
How did the OWASP Top 10 and the WSTG intersect?
As you can see here,
the OWASP Top 10,
A4, as you can tell I told you before, I like XXE.
The WSTG maps to that.
WSTG, INPV-07 is how to test for XML injections.
In every one of the Top 10 we can reference or turn to
the WSTG in our testing methodology
for that particular type of vulnerability.
As I said before, don't skip the appendix of the WSTG.
They give you a lot of resources,
they give you great tools that you can use for testing.
They give you suggested reading.
I love reading.
If you want to get into this space,
if you're interested in this space,
it's an older book, but I've referenced it here.
The web application hackers handbook Version 2 is
the physical Bible or you can get it on Kindle or e-book.
You can get that as well. It's a huge book,
but that's a great resource for those of us who
are in the web application hacking space.
It talks about different fuzzing vectors,
different resources you can use for fuzzing,
as well as encoded injections.
I talked about Web Application Firewall as before.
Sometimes using encodings a way to bypass a WAF.
They discussed that in the appendix of WSTG.
Not to be missed, don't miss the appendix.
In summary, we've discussed
>> why the WSTG is important and
>> how the OWASP Top 10 and WSTG intersect.
While we go through each of these modules,
we are not only going to be looking at the Top 10,
we're going to be looking at the WSTG
and I encourage you to look at that.
We talk about community injection,
SQL injection to look at the WSTG,
look at the testing methodology that they
recommend and use that to help you along the way.