pentest-guide - 基于OWASP的渗透测试指南，包括

项目说明

Penetration Test Guide based on the OWASP + Extra

This guide is for the penetration testers seeking for the appropriate test cases required during a penetration test project. I rearranged the OWASP Testing Guide v4 from my point of view including 9 Test Classes and each class has several Test Cases to conduct against the target. Each Test Case covers several OWASP tests which also is useful for the report document. I've also added 15 extra Tests Cases marked by the EXTRA-TEST. I hope it will be useful in both penetration test projects and bug-bounty.

TODO:

1. Add resources for each test.

Information Gathering

* * Fingerprint Technologies
* Fingerprint Web Server (OTG-INFO-002)
* Enumerate Applications on Webserver (OTG-INFO-004)
* Fingerprint Web Application 框架 (OTG-INFO-008)
* Fingerprint Web Application (OTG-INFO-009)
* * Information Leakage
* Conduct Search 引擎 Discovery and Reconnaissance for Information Leakage (OTG-INFO-001)
* Review Webser for Information Leakage (OTG-INFO-003)
* Review Webpage Comments and Metadata for Information Leakage (OTG-INFO-005)
* Analysis of Error Codes (OTG-ERR-001)
* Analysis of Stack Traces (OTG-ERR-002)
* Conduct a Fuzzing for Hidden and Sensiti or Directories (EXTRA-TEST-014)
* * Directory Indexing
* Search for Directory Indexing (EXTRA-TEST-001)
* * Storing Sensiti on Client Side
* Test Local Storage (OTG-CLIENT-012)

Configuration and Deployment Management

* * Enumerate Infrastructure and Application Admin Interfaces
* Enumerate Infrastructure and Application Admin Interfaces (OTG-CONFIG-005)
* Test 网络/Infrastructure Configuration (OTG-CONFIG-001)
* * Hidden Resources Discovery
* Review Old, Backup and Unreferenced Files for Sensiti (OTG-CONFIG-004)
* * HTTP Security Headers
* Testing for Lack of HTTP Security Headers (EXTRA-TEST-002)

Identity Management and Authentication

* * Secure Authentication Class
* Test User Registration Process (OTG-IDENT-002)
* Testing for Weak Lock Out Mechanism (OTG-AUTHN-003)
* Testing for Bypassing Authentication Schema (OTG-AUTHN-004)
* Test Remember Password Functionality (OTG-AUTHN-005)
* Testing for Browser Cache Weakness (OTG-AUTHN-006)
* Testing for Weak Security Question/Answer (OTG-AUTHN-008)
* Testing for Weak Password Change or Reset Functionalities (OTG-AUTHN-009)
* Testing for Weaker Authentication in Alternati (OTG-AUTHN-010)
* Testing for Weak or Unenforced Username Policy (OTG-IDENT-005)
* Testing for Default Credentials (OTG-AUTHN-002)
* Testing for Two Factor Authentication Bypass (EXTRA-TEST-012)
* * Username Enumeration
* Testing for Account Enumeration and Guessable User Account (OTG-IDENT-004)
* * Testing for Reco Sensiti
* Testing for Reco Sensiti from 数据库 (EXTRA-TEST-003)
* * Testing against Brute Force attack
* Testing against Brute Force attack (EXTRA-TEST-004)
* * Password policy
* Testing for Weak password policy (OTG-AUTHN-007)
* * Testing for SSL over User Authentication
* Testing for Credentials Transported over an Encrypted Channel (OTG-AUTHN-001)

Authorization and Boundary Test

* * User Access Control
* Test Role Definitions (OTG-IDENT-001)
* Test Account Pro Process (OTG-IDENT-003)
* Testing for Bypassing Authorization Schema (OTG-AUTHZ-002)
* Testing for Pri Escalation (OTG-AUTHZ-003)
* Testing for HTTP Verb Tampering (OTG-INP)
* Testing for JSON Web Token Flaw (EXTRA-TEST-006)
* Test Cross Origin Resource Sharing (OTG-客户端-007)
* * File Inclusions
* Testing Directory Tra/File Include (OTG-AUTHZ-001)
* * Execution after Redirect
* Execution after Redirect (EXTRA-TEST-005)
* * Cross Site Request Forgery
* Testing for Cross Site Request Forgery (CSRF) (OTG-SESS-005)
* * Secured File Upload
* Test Upload of Unexpected File Types (OTG-BUSLOGIC-008)
* Test Upload of Malicious Files (OTG-BUSLOGIC-009)
* * Insecure Direct Object References
* Testing for Insecure Direct Object References (OTG-AUTHZ-004)
* * Secured Captcha implementation
* Test for Secured Captcha Workflow (EXTRA-TEST-007)

Cookie and Session Management

* * Testing for Cookies attributes
* Testing for Cookies attributes (OTG-SESS-002)
* * Secure Session Management
* Testing for Bypassing Session Management Schema (OTG-SESS-001)
* Testing for Session Fixation (OTG-SESS-003)
* Testing for Exposed Session (OTG-SESS-004)
* Testing for Logout functionality (OTG-SESS-006)
* Test Session Timeout (OTG-SESS-007)
* Testing for Session puzzling (OTG-SESS-008)

Accessibility

* * Denial of Service
* Test for Denial of Service (EXTRA-TEST-008)

Input/Output

* * Cross Site Scripting
* Testing for Reflected Cross Site Scripting (OTG-INP)
* Testing for Stored Cross Site Scripting (OTG-INP)
* Testing for DOM based Cross Site Scripting (OTG-客户端-001)
* Testing for Ja Execution (OTG-客户端-002)
* Testing for HTML Injection (OTG-客户端-003)
* Testing for CSS Injection (OTG-客户端-005)
* Testing for 客户端 Side Resource Manipulation (OTG-客户端-006)
* Testing for Clickjacking (OTG-客户端-009)
* * SQL Injection
* Testing for SQL Injection (OTG-INP)
* Testing for Incubated (OTG-INP)
* * NoSQL Injection
* Testing for XPath Injection (OTG-INP)
* Testing for XML Injection (OTG-INP)
* Testing for MongoDB Injection (EXTRA-TEST-011)
* * Server Side Code Injection
* Testing for LDAP Injection (OTG-INP)
* Testing for ORM Injection (OTG-INP)
* Testing for SSI Injection (OTG-INP)
* IMAP/SMTP Injection (OTG-INP)
* Testing for Code Injection (OTG-INP)
* Testing for 服务端 Side Template Injection (EXTRA-TEST-013)
* * Remote Command Execution
* Testing for Command Injection (OTG-INP)
* * Buffer O
* Testing for Buffer O (OTG-INP)
* * XML External Entity (XXE)
* Testing for XML External Entity (XXE) (EXTRA-TEST-009)
* * Server Side Request Forgery (SSRF)
* Testing for 服务端 Side Request Forgery (SSRF) (EXTRA-TEST-010)
* * Open Redirect
* Testing for 客户端 Side URL Redirect (OTG-客户端-004)
* * HTTP Splitting/Smuggling
* Testing for HTTP Splitting/Smuggling (OTG-INP)
* * Race Condition
* Testing for Race Condition (EXTRA-TEST-15)

Testing for weak Cryptography

* * Testing for Weak SSL/TLS Ciphers, Insufficient Transport Layer Protection
* Testing for Weak SSL/TLS Ciphers, Insufficient Transport Layer Protection (OTG-CRYPST-001)
* * Testing for Sensiti Sent Channels
* Testing for Sensiti Sent Channels (OTG-CRYPST-003)
* Testing for Padding Oracle (OTG-CRYPST-002)

Workflow/Dataflow Tests

* * Business Logic Testing
* Test Business Logic Data (OTG-BUSLOGIC-001)
* Test Ability to Forge Requests (OTG-BUSLOGIC-002)
* Test Integrity Checks (OTG-BUSLOGIC-003)
* Test for Process Timing (OTG-BUSLOGIC-004)
* Test Number of Times a Function Can be Used Limits (OTG-BUSLOGIC-005)
* Test for the Circum of Work Flows (OTG-BUSLOGIC-006)
* Test Defenses Against Application Mis-use (OTG-BUSLOGIC-007)

项目信息

开发语言：未知

Star 数：2838

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Penetration tests guide based on OWASP including test cases, resources and examples.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。