license: MIT

├── .gitignore ├── leaders.md ├── Gemfile ├── _config.yml ├── assets └── images │ ├── README.md │ ├── OWASP_Incubator_Project.svg │ ├── License_MIT.svg │ └── owasp_level_incubator.svg ├── .github ├── dependabot.yml └── workflows │ └── validate-owasp-metadata.yaml ├── tab_example.md ├── info.md ├── README.md ├── 404.html ├── project.owasp.yaml └── index.md /.gitignore: -------------------------------------------------------------------------------- 1 | /Gemfile 2 | /Gemfile.lock 3 | /favicon.ico 4 | _site/ -------------------------------------------------------------------------------- /leaders.md: -------------------------------------------------------------------------------- 1 | ### Leaders 2 | * [Denis Podgurskii](mailto:denis.podgurskii@owasp.org) 3 | -------------------------------------------------------------------------------- /Gemfile: -------------------------------------------------------------------------------- 1 | source 'https://rubygems.org' 2 | group :jekyll_plugins do 3 | gem "github-pages" 4 | end -------------------------------------------------------------------------------- /_config.yml: -------------------------------------------------------------------------------- 1 | remote_theme: "owasp/www--site-theme@main" 2 | plugins: 3 | - jekyll-include-cache-0.2.0 -------------------------------------------------------------------------------- /assets/images/README.md: -------------------------------------------------------------------------------- 1 | # placeholder 2 | 3 | Put images you wish to link to in this folder 4 | 5 | link would be in form /assets/images/ 6 | -------------------------------------------------------------------------------- /.github/dependabot.yml: -------------------------------------------------------------------------------- 1 | version: 2 2 | updates: 3 | - package-ecosystem: github-actions 4 | directory: / 5 | schedule: 6 | interval: weekly 7 | time: '00:45' 8 | -------------------------------------------------------------------------------- /tab_example.md: -------------------------------------------------------------------------------- 1 | --- 2 | title: Example 3 | layout: null 4 | tab: true 5 | order: 1 6 | tags: example-tag 7 | --- 8 | 9 | ## Example 10 | 11 | Put whatever you like here: news, screenshots, features, supporters, or remove this file and don't use tabs at all. -------------------------------------------------------------------------------- /info.md: -------------------------------------------------------------------------------- 1 | ### Project Information 2 | *

3 | Incubator Project 4 | 5 | #### Classification 6 | * Tool 7 | 8 | #### Audience 9 | * Builder 10 | * Breaker 11 | * Defender 12 | 13 | ### Code Repository 14 | * [Github Repository](https://github.com/DenisPodgurskii/pentestkit) 15 | 16 | -------------------------------------------------------------------------------- /.github/workflows/validate-owasp-metadata.yaml: -------------------------------------------------------------------------------- 1 | name: Validate OWASP entity metadata 2 | 3 | on: 4 | pull_request: 5 | paths: 6 | - '*.owasp.yaml' 7 | push: 8 | paths: 9 | - '*.owasp.yaml' 10 | 11 | permissions: 12 | contents: read 13 | 14 | concurrency: 15 | cancel-in-progress: true 16 | group: ${{ github.repository }}-${{ github.workflow }}-${{ github.ref }} 17 | 18 | jobs: 19 | validate-metadata: 20 | runs-on: ubuntu-latest 21 | 22 | steps: 23 | - name: Checkout code 24 | uses: actions/checkout@v5 25 | 26 | - name: Validate metadata file 27 | uses: owasp/nest-schema/.github/actions/validate@a733198b4a942eb12d3ee8629cd9e0d409b1b2b9 28 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | ![OWASP Incubator](https://raw.githubusercontent.com/OWASP/www-project-penetration-testing-kit/main/assets/images/OWASP_Incubator_Project.svg) [![License](https://raw.githubusercontent.com/OWASP/www-project-penetration-testing-kit/main/assets/images/License_MIT.svg)](https://opensource.org/licenses/MIT) 2 | 3 | # ![Penetration Testing Kit](https://github.com/DenisPodgurskii/pentestkit/blob/master/src/ptk/browser/assets/images/ptk_icon_small.png) Penetration Testing Kit 4 | 5 | OWASP Foundation Web Respository for Penetration Testing Kit project 6 | 7 | Project's codebase Repository: [Penetration Testing Kit](https://github.com/DenisPodgurskii/pentestkit/) 8 | 9 | Please visit [Owasp Penetration Testing Kit](https://owasp.org/www-project-penetration-testing-kit/) for more information 10 | -------------------------------------------------------------------------------- /404.html: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | title: 404 - Not Found 4 | layout: col-generic 5 | 6 | --- 7 | 8 |

9 |

10 |

WHOA THAT PAGE CANNOT BE FOUND

11 |

Try the SEARCH function in the main navigation to find something. If you are looking for chapter information, please see Chapters for the correct chapter. For information about OWASP projects see Projects. For common attacks, vulnerabilities, or information about other community-led contributions see Contributed Content.

12 | 13 |

14 |

If all else fails you can search our historical site.

15 |

16 | -------------------------------------------------------------------------------- /project.owasp.yaml: -------------------------------------------------------------------------------- 1 | audience: 2 | - breaker 3 | - builder 4 | - defender 5 | leaders: 6 | - name: Denis Podgurskii 7 | email: denis.podgurskii@owasp.org 8 | github: DenisPodgurskii 9 | level: 2 10 | license: 11 | - AGPL-3.0 12 | name: OWASP Penetration Testing Kit 13 | pitch: PTK is a cross-browser extension that helps application security practitioners to get an insight into the app and do runtime scanning for SQL, XSS, 14 | OS Command injections, and more. 15 | repositories: 16 | - name: www-project-penetration-testing-kit 17 | url: https://github.com/OWASP/www-project-penetration-testing-kit 18 | description: OWASP Foundation Web Repository 19 | - name: pentestkit 20 | url: https://github.com/DenisPodgurskii/pentestkit 21 | description: OWASP PTK - application security browser extension. 22 | tags: 23 | - Penetration 24 | - Testing 25 | - Kit 26 | type: code 27 | website: https://owasp.org/www-project-penetration-testing-kit 28 | -------------------------------------------------------------------------------- /assets/images/OWASP_Incubator_Project.svg: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /assets/images/License_MIT.svg: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /assets/images/owasp_level_incubator.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 24 | -------------------------------------------------------------------------------- /index.md: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | layout: col-sidebar 4 | title: OWASP Penetration Testing Kit 5 | tags: Penetration Testing Kit 6 | level: 2 7 | type: code 8 | pitch: PTK is a cross-browser extension that helps application security practitioners to get an insight into the app and do runtime scanning for SQL, XSS, OS Command injections, and more. 9 | 10 | --- 11 | ![Penetration Testing Kit Logo](https://raw.githubusercontent.com/DenisPodgurskii/pentestkit/master/src/ptk/browser/assets/images/ptk_icon_small.png) 12 | 13 | 14 | ![OWASP Incubator](https://raw.githubusercontent.com/OWASP/www-project-penetration-testing-kit/main/assets/images/OWASP_Incubator_Project.svg) [![License](https://raw.githubusercontent.com/OWASP/www-project-penetration-testing-kit/main/assets/images/License_MIT.svg)](https://opensource.org/licenses/MIT) 15 | 16 | Support OWASP PTK [Donate](https://www.paypal.com/donate/?hosted_button_id=RNE87MVGX576E) 17 | 18 | 19 | **The OWASP Penetration Testing Kit (PTK)** browser extension is your all-in-one solution for streamlining your daily AppSec tasks. Whether you’re a penetration tester, a Red Team member, or an AppSec practitioner, OWASP PTK enhances your efficiency and provides deep insights into your target application. 20 | 21 | **Key Features:** 22 | 23 | * **Runtime Scanning (DAST & IAST & SAST & SCA):** 24 | Perform Dynamic Application Security Testing, Static Analysis, In-Browser IAST and Software Composition Analysis on the fly. Identify SQL injection, command injection, reflected/stored XSS, SQL auth bypass, XPath injections, JWT attacks, and other complex threats. 25 | 26 | * **Static Analysis (SAST):** 27 | PTK automatically parses loaded JavaScript, HTML, and CSS right in your browser—before any code ever runs. It flags unsafe patterns like `eval()`, `innerHTML`/`outerHTML` injection, insecure cryptographic calls, missing input sanitization, and common anti-patterns. 28 | 29 | * **In-Browser IAST (Interactive Application Security Testing):** 30 | PTK’s built-in IAST engine instruments your app at runtime—right in the browser—tracking taint flows and code execution to flag vulnerabilities as they occur. Catch issues like DOM-based XSS, unsafe `eval`/`innerHTML` usage, open-redirects, and more without leaving your dev tools. 31 | 32 | * **JWT Inspector:** 33 | Analyze, craft, and tamper with JSON Web Tokens. Generate keys, test null signatures, brute-force HMAC secrets, and inject malicious `jwk`, `jku`, or `kid` parameters. 34 | 35 | * **Insightful Application Info:** 36 | One-click visibility into tech stacks, WAFs, security headers, crawled links, and authentication flows. 37 | 38 | * **Built-in Proxy & Traffic Log:** 39 | Capture all HTTP(S) traffic, replay requests in R-Builder, and automate XSS, SQLi, and OS command injection. 40 | 41 | * **R-Builder for Request Tampering & Smuggling:** 42 | Craft and manipulate HTTP requests, including complex request-smuggling techniques. Now with cURL import/export. 43 | 44 | * **Cookie Management:** 45 | Add, edit, remove, block, protect, export, and import cookies from a powerful in-browser editor. 46 | 47 | * **Decoder/Encoder Utility:** 48 | Instantly convert between UTF-8, Base64, MD5, URL-encode/decode, and more formats. 49 | 50 | * **Swagger.IO Integration:** 51 | Browse and interact with API endpoints directly from your Swagger documentation. 52 | 53 | * **Selenium Integration:** 54 | Shift left security by running automated Selenium tests with built-in vulnerability checks. 55 | 56 | Enhance your AppSec practice with PTK—the extension that makes your browser smarter and your testing faster. Install today and start uncovering vulnerabilities in real time! 57 | 58 | 59 | ## Installation 60 | 61 | [Firefox](https://addons.mozilla.org/en-US/firefox/addon/owasp-penetration-testing-kit/) 62 | 63 | [Chrome](https://chrome.google.com/webstore/detail/penetration-testing-kit/ojkchikaholjmcnefhjlbohackpeeknd) 64 | 65 | [MS Edge](https://microsoftedge.microsoft.com/addons/detail/penetration-testing-kit/knjnghhnhcpcglfdjppffbpfndeebkdm) 66 | 67 | 68 | ## Documentation / How To 69 | 70 | [Website](https://pentestkit.co.uk/) 71 | 72 | 73 | ## Youtube channel 74 | 75 | [Youtube channel](https://www.youtube.com/channel/UCbEcTounPkV1aitE1egXfqw) 76 | 77 | 78 | --------------------------------------------------------------------------------