OWASP Penetration Testing Kit (PTK)

Security testing from the browser's authenticated application context.

OWASP PTK is an open-source browser extension for testing authenticated web applications and single-page applications from the browser session where they are exercised. It combines DAST, client-side SAST, in-browser IAST, SCA, traffic inspection, request replay, JWT testing, and browser storage tools using the authentication, application state, API traffic, DOM, and client-side code visible to the browser.

Install for Chrome · Install for Edge · Install for Firefox · Pentester Guide · PTK Agent

A real PTK DAST result from an authorised local OWASP Juice Shop smoke: the finding records the scoped URL, affected parameter, executed/reflected proof, sink type, element, event attribute, DOM path, and confidence.

Why browser context matters

Modern applications place important security state in the browser: authenticated cookies, storage tokens, dynamically generated API calls, client-side routes, DOM mutations, and JavaScript execution. PTK tests from that live context so it can inspect behaviour that a disconnected HTTP scanner may not see.

PTK still requires an explicit scope. Only test applications you are authorised to assess, keep third-party origins out of scope, and review active-scan settings before sending payloads.

Core capabilities

Area	What PTK provides
DAST	Active tests against selected browser traffic, pages, and parameters, with request, payload, response, and evidence captured for findings.
Client-side SAST	Analysis of JavaScript and other client resources loaded by the browser for risky sources, sinks, APIs, routes, and implementation patterns.
In-browser IAST	Runtime instrumentation that observes client-side data flows and dangerous operations while application workflows execute.
SCA	Identification of browser-visible third-party components and known vulnerable versions.
Manual testing	Proxy and traffic history, R-Builder request replay and tampering, JWT analysis, cookies and storage, encoding tools, technology detection, WAF/CDN evidence, and security-header review.
Reporting	Finding triage and export with engine, severity, affected request or resource, evidence, and remediation context.

Choose the right PTK component

Product	Use
OWASP PTK	Full interactive browser extension for manual and assisted application security testing.
PTK Auto	Restricted browser-side runtime controlled by an authorised automation session. It does not expose the full interactive PTK workspace.
PTK Agent / pentestkit npm package	CLI, Playwright, Selenium, Puppeteer, Cypress, CI/CD, and supported remote-browser orchestration. Source and documentation live in ptklabs/ptk-agent.
OWASP ZAP integration	ZAP-controlled browser sessions using the full PTK extension, with PTK findings published as ZAP alerts.

Quick start

1. Install OWASP PTK from the store for your browser.
2. Create a dedicated testing profile and open an application that is explicitly in scope.
3. Sign in with a test account and exercise the important application workflows.
4. Open PTK and review the Dashboard, captured traffic, cookies, storage, technologies, and headers.
5. Run a bounded scan with the required DAST, SAST, IAST, or SCA engines, then validate each result before reporting it.

For a deliberately vulnerable local target, follow the official OWASP Juice Shop setup, browse it with a test account, and use the Pentester Guide to run a small authorised scan. Start with low concurrency and a narrow route or request selection.

Automation with PTK Agent

Install the published pentestkit package when PTK needs to run from tests, a CLI workflow, CI/CD, or a supported browser provider:

npm install --save-dev pentestkit
npx playwright install chromium
npx ptk-agent --doctor-extension

PTK Agent controls PTK Auto and owns automation configuration, scope, results, and artifacts. See the canonical PTK Agent documentation for CLI commands, frameworks, providers, scenarios, and CI examples.

OWASP ZAP integration

The OWASP PTK add-on for ZAP launches supported browser sessions with the full PTK extension and imports PTK findings into ZAP. ZAP automation plans must enable the PTK active-scan rule, and the selected scan policy must include the attack rules required by the test.

Documentation

• Pentester Guide
• Installation and first run
• Scanning engines
• Manual testing tools
• Reporting
• Automation and ZAP
• PTK Agent and npm documentation
• OWASP project page

Build from source

git clone https://github.com/DenisPodgurskii/pentestkit.git
cd pentestkit
npm ci
npm run build_pkg

npm run build_pkg builds the Chromium and Firefox variants of OWASP PTK and PTK Auto under dist/. For Chromium development, npm run build also prepares src/, which can be loaded from the browser's extension page with developer mode enabled.

Development requirements and testing expectations are documented in CONTRIBUTING.md.

Contributing and support

Bug reports, feature requests, and pull requests are welcome. Use GitHub Issues for public bugs and feature discussions. Report security vulnerabilities privately as described in SECURITY.md.

PTK performs active security testing and may change application state or generate significant traffic. Use it only with explicit authorisation and within the agreed scope, rate limits, accounts, and testing window.

License

OWASP PTK is licensed under the GNU Affero General Public License v3.0.