OWASP PTK Pentester Guide

July 29, 2026 ยท View on GitHub

This guide is the practical entry point for pentesters using OWASP Penetration Testing Kit (PTK). It explains what PTK does, how to set it up, how to run browser-based DAST/IAST/SAST/SCA checks, how to use the manual tools, and how to turn results into useful evidence.

Who This Is For

  • Penetration testers and red teamers
  • Bug bounty hunters
  • AppSec engineers validating fixes
  • Developers and QA engineers adding security checks to browser workflows
  • Automation engineers running PTK from npm, Playwright, Selenium, Cypress, CI, or OWASP ZAP

Safe-Use Rules

Use PTK only against systems where you have explicit authorization. Active scans, request tampering, JWT manipulation, request smuggling research, and automated crawls can change application state, trigger monitoring, or generate load.

Before testing, confirm:

  • exact target domains and out-of-scope systems
  • allowed user roles and test accounts
  • testing windows and rate limits
  • whether destructive or state-changing actions are allowed
  • what evidence may be stored, shared, or exported

Recommended defaults:

AreaDefault
Browser profileUse a dedicated PTK testing profile
AccountsUse test accounts, not personal or production accounts
ScopeKeep a written in-scope domain/path list
RateStart with low request rate and low concurrency
Destructive actionsDisable unless explicitly authorized
SecretsUse environment variables or CI secrets
EvidenceRedact tokens, cookies, passwords, and personal data
ArtifactsDo not commit browser profiles, cookies, traces, or scan exports

Guide Map

PageUse It For
ConceptsPTK architecture, browser context, DAST/IAST/SAST/SCA, and engine selection
InstallationBrowser stores, source builds, npm automation, ZAP add-on, and first-run checks
Pentest WorkflowA practical engagement flow from setup to recon, active testing, triage, and retest
Scanning EnginesHow to run and triage DAST, IAST, SAST, and SCA
Manual ToolsProxy, traffic log, R-Builder, JWT Inspector, cookies, storage, request smuggling, and utilities
ReportingEvidence collection, triage rules, report structure, and templates
Automation and ZAPnpm/CLI usage, scenarios, CI, PTK Agent, SDKs, and OWASP ZAP integration
TroubleshootingCommon setup, bridge, export, auth, scenario, active scan, and ZAP issues

Fast Path

  1. Install PTK in a dedicated browser profile.
  2. Open the authorized target and sign in with a test account.
  3. Browse the main workflows manually: login, search, profile, basket/order, account settings, upload, admin, or role-specific flows.
  4. Open PTK and review Dashboard, Proxy, cookies/storage, technologies, headers, and crawled links.
  5. Run a bounded DAST scan on important pages or selected requests.
  6. Enable IAST while exercising SPA and JavaScript-heavy workflows.
  7. Run SAST on loaded scripts to find client-side sources, sinks, hidden routes, and risky JavaScript.
  8. Run SCA to identify vulnerable client-side libraries.
  9. Send interesting requests to R-Builder for manual tampering.
  10. Export findings and write reports with reproducible steps, impact, evidence, and remediation.

Learning Path

These videos are the approved current learning references for this guide:

TopicVideo
Starter workflow3 easy steps to start your bug bounty
PTK 9.8 workflowOWASP PTK 9 8 0
SAST / DOM XSSOWASP PTK SAST catches a DOM-based XSS vulnerability on PortSwigger's lab
JWT testingHow to solve JWT PortSwigger labs using OWASP PTK
ZAP integrationOWASP PTK + ZAP
Automation and Codex workflowOWASP PTK and Codex
Request smugglingOWASP PTK #8 4 3 request smuggling

Primary References