OWASP Penetration Testing Kit

The OWASP Penetration Testing Kit (PTK) browser extension is your all-in-one tool for streamlining AppSec tasks. Whether you’re a penetration tester, Red Team member, or security practitioner, PTK accelerates vulnerability discovery with runtime DAST, SAST, IAST, and SCA capabilities, surfacing issues such as XSS, SQLi, command injection, JWT flaws, and more without leaving your browser.

PTK includes in-browser static analysis of loaded JS/HTML/CSS, an interactive IAST engine that tracks taint and execution at runtime, a JWT Inspector for crafting and validating tokens, a built-in proxy with a traffic log and request replay, and the R-Builder for advanced tampering. It also offers cookie management, a decoder/encoder, Swagger.IO integration for API docs, and Selenium testing support, plus one-click insights into tech stacks, headers, authentication flows, and security policies to speed up assessments.