OWASP Penetration Testing Kit

OWASP Penetration Testing Kit

OWASP PTK: All-In-One Pen Testing Browser Extension

The 'OWASP Penetration Testing Kit' is a comprehensive Chrome extension tailored for security professionals. It integrates DAST, SCA, and JWT inspection into your browser for enhanced testing efficiency. Discover vulnerabilities right from your browser, craft HTTP requests with R-Builder, analyze security with JWT Inspector, manage cookies, and encode or decode data. Additionally, PTK's traffic log proxy and integrations with Swagger.IO and Selenium facilitate a more robust security workflow.
Install from Chrome Web Store

Extension stats

Users: 20,000+
Rating: 4.81
(43)
Version: 8.9.3 (Last updated: 2024-05-06)
Creation date: 2020-06-26
Risk impact: Very high risk impact
Risk likelihood:
Manifest version: 3
Permissions:
  • activeTab
  • cookies
  • notifications
  • storage
  • unlimitedStorage
  • tabs
  • webRequest
  • background
  • debugger
  • scripting
  • See more
Host permissions:
  • <all_urls>
  • *://*/*
Size: 7.49M

Other platforms

Not available on Android
OWASP Penetration Testing Kit (v8.9.2)
4.69 (13) 1,822+
OWASP Penetration Testing Kit (v8.9.3)
4.80 (24) 6,019+
Want to check extension ranking and stats more quickly for other Chrome extensions? Install Chrome-Stats extension to view Chrome-Stats data as you browse the Chrome Web Store.

Extension summary

The Penetration Testing Kit (PTK) browser extension is your all-in-one solution for streamlining your daily tasks in the realm of application security. Whether you're a penetration tester, a member of a Red Team, or an application security practitioner, this extension is designed to enhance your efficiency and provide valuable insights.

Key Features: In-Browser Runtime Scanning: PTK offers Dynamic Application Security Testing (DAST) and Software Composition Analysis (SCA) scanning right within your browser. Detect SQL Injections, Command Line Injections, Stored and Reflected Cross-Site Scripting (XSS) vulnerabilities, and more. It even identifies complex threats like SQL Authentication Bypass, XPath injections, and JWT attacks.

JWT Inspector: We've added a crucial new feature – JWT Inspector. It empowers you to analyze JSON Web Tokens (JWT), build new tokens, and generate public and private keys for JWT signing. PTK makes easy a lot of JWT attacks including null signature, none algorithm, brute force HMAC secret, key/algorithm confusion, JWK injection, JKU injection, and kid parameter injection.

Insightful Information: Get a one-click access to insightful information about the target application, including its technology stack, Web Application Firewalls (WAFs), security headers, crawled links, and authentication flow.

Proxy with Traffic Log: PTK includes a proxy with a detailed traffic log. This log allows you to repeat any request in the R-Builder or send it to the R-Attacker. You can automate the execution of Cross-Site Scripting (XSS), SQL injection, or OS Command injections.

R-Builder for Request Tampering and Request Smuggling: The extension includes R-Builder, a powerful tool that allows you to craft and manipulate HTTP requests with precision. Use R-Builder to modify and tamper with requests, enabling you to test the robustness of the application's security. R-Builder empowers you to execute complex maneuvers, including HTTP request smuggling attacks, for a comprehensive assessment of application vulnerabilities. Now with cURL support - copy or paste your cURL request and execute in a second.

Cookie Management: The extension includes a cookie editor, allowing you to manage cookies efficiently. Add, edit, remove, block, protect, export, and import cookies with ease.

See more

User reviews

These summaries are automatically generated weekly using AI based on recent user reviews. Chrome Web Store does not verify user reviews, so some user reviews may be inaccurate, spammy, or outdated.
Pros
  • JWT Inspector is highly praised for securing token-based authentication.
  • Request Builder is consistently noted as user-friendly and efficient for executing modified requests.
  • Request Attacker is recognized for effectively finding XSS and SQL Injection vulnerabilities.
  • SCA scan with reporting is considered a valuable tool for comprehensive security checks.
Cons
  • Does not work on Arc browser.
Most mentioned
  • Request Builder
  • JWT Inspector
  • Request Attacker
  • SCA scan with reporting
User reviews
Works on Chrome and other Chrome-based browsers. Sadly, won't work on Arc browser :(
by Dan Cristino, 2024-08-31

Helpful stuff thanks!
by Przemysław Samsel, 2024-04-13

Wonderful extension
by gideon adavize, 2024-01-26
View all user reviews

Extension safety

Risk impact

OWASP Penetration Testing Kit requires a lot of sensitive permissions. Exercise caution before installing.

Risk likelihood

OWASP Penetration Testing Kit may not be trust-worthy. Avoid installing if possible unless you really trust this publisher.

Upgrade to see risk analysis details

Promo images

OWASP Penetration Testing Kit small promo image
Small promo image

Similar extensions

Here are some Chrome extensions that are similar to OWASP Penetration Testing Kit: