WSTG - Latest | OWASP Foundation
WSTG - Latest on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
OWASP’s 2021 Board of Directors Chairman, Sherif Mansour, was recently diagnosed with acute myeloid leukemia. To help him, and everyone affected by blood cancers, the OWASP Foundation is organizing a blood donation drive. Please show your support by donating blood today!| OWASP
cdxgen and CycloneDX .NET participated in the GitHub Secure Open Source Fund| OWASP
WSTG - Latest on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
CICD-SEC-4: Poisoned Pipeline Execution (PPE) on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Binary Planting on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Steve Springett on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Improper Data Validation on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Vulnerabilities on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
The Ten Most Critical API Security Risks| owasp.org
XML External Entity (XXE) Processing on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Unrestricted File Upload on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
OWASP Partners with InfoSecMap to Strengthen Global InfoSec Collaboration| OWASP
OWASP Automated Threats to Web Applications on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
The Ten Most Critical API Security Risks| owasp.org
The Ten Most Critical API Security Risks| owasp.org
We’re proud to share that OWASP is once again an official mentoring organization for Google Summer of Code (GSoC) 2025—and this year, we’ve secured 15 contributor slots across some of the most impactful open-source security projects in the world.| OWASP
OWASP has forged a coalition between the global security community and formal standardization bodies on AI. The ‘AI Exchange’ Project is now driving the creation of AI security standards that protect people and businesses while still allowing innovation to thrive.| OWASP
In response to increasing concerns over the effectiveness of the CVE Program and the sustainability of the U.S. government’s role in managing the world’s largest vulnerability database, cybersecurity leaders and international stakeholders are coming together to explore a federated model for vulnerability identification. The initiative seeks to address modern security challenges—such as the shift toward hyper-automation, the dominance of open-source software, and emerging needs in crypto...| OWASP
Introduction| OWASP
Traditionally OWASP offered in-person instructor led trainings as a part of Global AppSec Conferences which take place two or three times a year.| OWASP
The OWASP Foundation, in collaboration with the Cyber Security Agency (CSA) of Singapore, presents this advisory on using Software Bill of Materials (SBOM) for enhanced vulnerability management, highlighting OWASP CycloneDX—a format standardized by Ecma International as ECMA-424 —and underscoring OWASP’s joint efforts with both Ecma International and CSA. The advisory also features OWASP Dependency-Track the reference platform for how to consume and analyze SBOMs. For details, including...| OWASP
OWASP Juice Shop proudly announces long-time contributor Jannik Hollenbach as co-project lead effective immediately! Additionally, we are enhancing and simplifying our contributor engagement & recognition. Read on to learn more about these changes and how you can get involved in the project!| OWASP
A new OWASP project - Common Lifecycle Enumeration - aims to standardize encodings of product lifecycle events, such as end-of-life, end-of-support and others. The specification will become an ECMA International standard when ready. Read more about this exciting new OWASP project!| OWASP
Welcome to the annual More than a Password Day! To celebrate this year’s event, OWASP is enabling multi-factor authentication across the OWASP Foundation’s infrastructure. This is a significant step forward in securing our systems and data. At the start of this year’s event, we had only 21% of all OWASP accounts enrolled in MFA. We’re aiming to increase this to 100% by the end of the year.| OWASP
Over the last several months, OWASP, particularly the owasp.com domain, has been blocked from sending messages to tenants of the Microsoft Office 365 platform or those using Microsoft Defender for Office 365, where messages end up blacklisted in quarantine or never received. Organizations that have failed to receive our emails includes legal firms, our HR firm, our accountants, our European affiliate’s accountants and VAT specialists, and many others, including potential sponsors, donors, a...| OWASP
React Native is a popular cross-platform mobile development framework that allows developers to build native-looking apps for iOS and Android using a single codebase. Like any other software, React Native apps are also vulnerable to a variety of security threats.| OWASP
Recently, Google, Microsoft, and Yahoo and other major email providers have been implementing stricter email authentication controls. This is a good thing, as it helps to reduce the amount of spam and phishing emails that we all receive. However, it can also cause problems for legitimate email senders, such as OWASP. In the last month or so, we have experienced great difficulty in sending emails to Microsoft email addresses (Office 365, Exchange Online, Outlook, Hotmail, Live, etc). This has ...| OWASP
I’m excited to announce that OWASP’s restated Articles and Certificate of Incorporation and new Bylaws have been approved by the Delaware Secretary of State. These documents are the foundation of our governance and provide the framework for how the Foundation operates. The new bylaws are the result of a comprehensive review and update process that began in 2021. The changes are designed to modernize and streamline the governance of the Foundation, and to ensure that we are operating in th...| OWASP
The OWASP Application Security Verification Standard (ASVS) Project held it’s first ever, in-person, community meetup during last week’s Global AppSec Lisbon conference. This was an exciting opportunity for anyone interested in the project to come and meet some of the leaders, discover how to get involved and learn about our upcoming plans. We are super grateful to our friends at Jit for their supporting in running the event.| OWASP
SecureFlag and OWASP partner to offer Threat Modeling Automation tool ThreatCanvas to Members| OWASP
Colorado Springs, CO, April 22, 2024 – OWASP is thrilled to announce the addition of Starr Brown to the OWASP Foundation team. As the newly appointed Director of Projects, Starr brings a wealth of expertise and a fresh perspective to our community.| OWASP
Colorado Springs, April 21, 2024 – Although the OWASP community is 23 years old, today the OWASP Foundation proudly commemorates its 20th year in operation, marking two decades of unwavering commitment to securing the digital landscape. As a global leader in open-source information, industry-leading projects, and a thriving community of peers, OWASP has left an indelible mark on application security and DevSecOps.| OWASP
OWASP Foundation, the Open Source Foundation for Application Security on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
OWASP Threat Dragon is a threat modeling tool; great for both developers and defenders alike. Use on your desktop or as a web application.| owasp.org
Path Traversal on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Resource Injection on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Attacks on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
WSTG - v4.2 on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Central repository of threat modeling information, techniques, and methodologies| owasp.org
Threat Modeling on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
The SBOM Forum identifies and tries to find solutions to problems that are preventing widespread distribution and use of software bills of materials (SBOMs) by organizations whose primary business is not software development.| owasp.org
Guidance on designing, creating, testing, and procuring secure and privacy-preserving AI systems| owasp.org
Using freed memory on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Doubly freeing memory on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
The Ten Most Critical API Security Risks| owasp.org
OWASP Mobile Top 10 on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
PHP Object Injection on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Regular expression Denial of Service - ReDoS on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Buffer Overflow on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
GSoC 2020 on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
The OWASP Application Security Verification Standard (ASVS) Project is a framework of security requirements that focus on defining the security controls required when designing, developing and testing modern web applications and web services.| owasp.org
The Ten Most Critical API Security Risks| owasp.org
Controls on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Format string attack on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
OWASP API Security Top 10 2023 edition| owasp.org
Denial of Service on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
OWASP Cornucopia on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
The Ten Most Critical API Security Risks| owasp.org
The Ten Most Critical API Security Risks| owasp.org
OWASP Top 10:2021| owasp.org
CORS OriginHeaderScrutiny on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Deserialization of untrusted data on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Broken Access Control on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
OWASP Top 10:2021| owasp.org
Source Code Analysis Tools on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Probably the most modern and sophisticated insecure web application for security trainings, awareness demos and CTFs. Also great voluntary guinea pig for your security tools and DevSecOps pipelines!| owasp.org
Server Side Request Forgery on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Code Injection on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
SameSite on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
OWASP CSRFGuard is a library that implements a variant of the synchronizer token pattern to mitigate the risk of Cross-Site Request Forgery (CSRF) attacks.| owasp.org
OWASP Risk Rating Methodology on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
OWASP Code Review Guide on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Provides technical information about HTTP security headers.| owasp.org
OWASP Saitama on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Certificate and Public Key Pinning on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
OWASP Top 10:2021| owasp.org
OWASP Top 10:2021| owasp.org
Aims to educate developers, designers, architects, managers, and organizations about the potential security risks when deploying and managing Large Language Models (LLMs)| owasp.org
Threat Modeling Process on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
OWASP Top 10:2021| owasp.org
OWASP Top 10:2021| owasp.org
OWASP Java Encoder on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
OWASP Enterprise Security API (ESAPI) on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Command Injection on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
SQL Injection on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
The OWASP Top 10 is the reference standard for the most critical web application security risks. Adopting the OWASP Top 10 is perhaps the most effective first step towards changing your software development culture focused on producing secure code.| owasp.org
Credential stuffing on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Session fixation on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
The Web Security Testing Guide (WSTG) Project produces the premier cybersecurity testing resource for web application developers and security professionals.| owasp.org
DOM Based XSS on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Cross Site Request Forgery (CSRF) on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
OWASP API Security Project on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
Cross Site Scripting (XSS) on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.| owasp.org
OWASP Top 10:2021| owasp.org
