OWASP Penetration Testing Kit (PTK)

The OWASP Penetration Testing Kit (PTK) browser extension is your all-in-one solution for streamlining your daily AppSec tasks. Whether you’re a penetration tester, a Red Team member, or an AppSec practitioner, OWASP PTK enhances your efficiency and provides deep insights into your target application.

Key Features:

Runtime Scanning (DAST & IAST & SAST & SCA): Perform Dynamic Application Security Testing, Static Analysis, In-Browser IAST and Software Composition Analysis on the fly. Identify SQL injection, command injection, reflected/stored XSS, SQL auth bypass, XPath injections, JWT attacks, and other complex threats.
Static Analysis (SAST): PTK automatically parses loaded JavaScript, HTML, and CSS right in your browser—before any code ever runs. It flags unsafe patterns like eval(), innerHTML/outerHTML injection, insecure cryptographic calls, missing input sanitization, and common anti-patterns.
In-Browser IAST (Interactive Application Security Testing): PTK’s built-in IAST engine instruments your app at runtime—right in the browser—tracking taint flows and code execution to flag vulnerabilities as they occur. Catch issues like DOM-based XSS, unsafe eval/innerHTML usage, open-redirects, and more without leaving your dev tools.
JWT Inspector: Analyze, craft, and tamper with JSON Web Tokens. Generate keys, test null signatures, brute-force HMAC secrets, and inject malicious jwk, jku, or kid parameters.
Insightful Application Info: One-click visibility into tech stacks, WAFs, security headers, crawled links, and authentication flows.
Built-in Proxy & Traffic Log: Capture all HTTP(S) traffic, replay requests in R-Builder, and automate XSS, SQLi, and OS command injection.
R-Builder for Request Tampering & Smuggling: Craft and manipulate HTTP requests, including complex request-smuggling techniques. Now with cURL import/export.
Cookie Management: Add, edit, remove, block, protect, export, and import cookies from a powerful in-browser editor.
Decoder/Encoder Utility: Instantly convert between UTF-8, Base64, MD5, URL-encode/decode, and more formats.
Selenium Integration: Shift left security by running automated Selenium tests with built-in vulnerability checks.

Enhance your AppSec practice with PTK—the extension that makes your browser smarter and your testing faster. Install today and start uncovering vulnerabilities in real time!

Development

git clone git@github.com:DenisPodgurskii/pentestkit.git
cd pentestkit
npm install
npm run build

Chrome/Edge/Brave -> Extensions -> Load unpacked -> select pentestkit/src directory

Or run

npm run build_pkg

This will create zip arhives in pentestkit/dist folder

On Windows build it's a chance you can expect an error during build process. In this case try to execute the following command first.

npm install --ignore-scripts fomantic-ui

Installation

Firefox

Chrome

MS Edge

Documentation / How To

Website

Support

For questions, bug reports, and feature requests, please use GitHub Issues:
https://github.com/DenisPodgurskii/pentestkit/issues

Youtube channel

BrowserStack

This project is tested with BrowserStack

Pentestkit

Install / Use

README