Automating Security Testing with the OWTF
summary
OWTF automates web pen testing by wiring together command-line scanners and a web UI running on Python/Postgres so a QA pipeline can run OWTF against targets on Kali or Docker. It orchestrates discovery tools like Arachni w3 AF dirbuster and WP scan, exposes passive / semi‑passive / active modes, and ships ~137 plugins (about 121 from the OWASP testing guide) including SSL/TLS checks, six XSS tests and a dozen injection tests. It produces request/response logs, copy‑paste exploit commands, worker/worklist parallelism, but has rough edges (500 errors, dependency quirks).
AI-written summary · about
chapters (27)
- 0:00Start
- 1:56COMPLIANCE VS. SECURITY
- 6:22POSITIVE TESTING VS. NEGATIVE TESTING
- 8:28BASIC STRUCTURE
- 9:16OWASP TESTING PROJECT
- 10:17NIST SP 800-115
- 13:15PENETRATION TESTING EXECUTION STANDARD
- 14:12OWTF TECH SPECS
- 14:46UNDER THE HOOD
- 16:30TEST SEPARATION BY PLUGIN
- 20:48INSTALLATION
- 22:25OWTF DOCUMENTATION
- 22:37STARTING OWTF
- 23:53USING SESSIONS
- 25:30CHOOSE YOUR WEAPON(S)
- 26:52UNDERSTANDING PLUGINS
- 27:42ANALYZING RESULTS
- 28:27SAVING YOUR ANALYSIS
- 29:16ADVANCED FILTER
- 29:34MANAGING WORKERS
- 30:10MANAGING WORKLISTS
- 31:01TEST SSL/TLS CONFIG
- 31:57TEST FOR XSS
- 32:16TEST FOR INJECTION FLAWS
- 48:48QUICK TIPS
- 51:21YOUR HOMEWORK - TRIAL RUN
- 52:24RESOURCES
related talks
33mWAFs FTW! A modern devops approach to security testing your WAF
13mFlagship Projects: OWTF Flagship Project
46mAutomating Security Testing with Functional Testing Test Cases
54mAutomated Security Testing with OWASP Nettacker
01h 00mWriting Security unit integration Tests using the OWASP O2 Platform
01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slideless
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
56mAutomated Security Testing With OWASP Nettacker