The OWASP Web Security Testing Guide, or WSTG, is a flagship OWASP documentation project and a testing resource for web application developers and security professionals. Use it as a structured checklist of what to test, applied to a training app you own, so your testing is methodical rather than random.
What it is
The project page describes the WSTG as a premier cybersecurity testing resource. The latest listed release is version 4.2, available as a web version and a PDF, and version 5.0 is in development. Check the project page for the current state before you cite a version in a report or an interview.
How it differs from the OWASP Top 10
The Top 10 is an awareness document listing risk categories. The WSTG is a testing guide. One tells you what kinds of problems matter, the other tells you how to go looking for them. They pair well: pick a Top 10 category, then find the matching testing material.
| Resource | Use it to |
|---|---|
| OWASP Top 10 2025 | Learn the risk vocabulary |
| WSTG | Plan and perform tests |
| Training app such as Juice Shop | Practice legally and safely |
A method for using it
- Pick a target you own or a deliberately insecure training app on localhost.
- Choose one area of the guide, for example authentication or session handling.
- List the tests the guide describes for that area.
- Run each test and record what you did and what the app did.
- For each issue, write the fix a developer should apply.
- Retest after the fix to confirm.
Doing one area deeply beats skimming all of it.
Keep it legal
OWASP's own WebGoat page tells learners to use these techniques only for education and never to look for vulnerabilities in systems they do not have explicit permission to test. The same applies when you use the WSTG. A guide that tells you how to test does not give you permission to test.
If you want to practice on real sites, look for a published vulnerability disclosure policy and stay inside its stated scope. Our post on setting up a safe home lab covers the setup.
What to produce
A test log in your repository: area, test, result, evidence, fix. Treat it as a portfolio piece. Employers who read it see how you think, which a certificate does not show.
Limits
A guide is a plan, not a guarantee. Following it does not prove an app is secure, and automated scanners will not cover every item. Use judgment, and read the actual guide text, since this post is a summary.
Quick check
Is the WSTG a tool I run?
No. It is a documentation resource that describes how to test.
Do I need to read all of it?
No. Pick one area, test it properly, then move to the next.
Sources
Last reviewed: 19 October 2026.
