pentestkit

Cross-browser extension Penetration Testing Kit

[pentestkit @pentestkit]

𝗢𝗪𝗔𝗦𝗣 𝗣𝗧𝗞 𝗶𝘀 𝗻𝗼𝘄 𝗮𝘃𝗮𝗶𝗹𝗮𝗯𝗹𝗲 𝗮𝘀 𝗮𝗻 𝗻𝗽𝗺 𝗽𝗮𝗰𝗸𝗮𝗴𝗲
Instead of treating browser security testing as a separate manual activity, teams can now run PTK-backed scans as part of automation.

https://t.co/gjAifVjuoQ

[Zed Attack Proxy @zaproxy]

Blog: Automating OWASP PTK with ZAP (Phase 1)
You can now automate @OWASP @pentestkit using ZAP
https://t.co/hbjQcCqpIa
#zaproxy #owasp #appsec

[pentestkit @pentestkit]

I wrote a scenario like a prompt, hit run… and Codex just did the job.
Playwright is driving the browser.
OWASP PTK is turning it into real DAST/IAST findings.
It even solved a math captcha on its own.
This is what crawling should look like.
https://t.co/5JlkA9X4B7

[pentestkit @pentestkit]

@DerrickShieldsX - is it you? Peritus Labs says it’s “The Data Consultancy for Serious Organizations.” Odd, because posting “PTK got hacked” in public and asking me to chase you for the details is the opposite of serious. Report privately, with evidence. Or say it wasn’t you.

[Zed Attack Proxy @zaproxy]

Blog: ZAP Updates for March:
https://t.co/RS700RekpN
ZAP was started 9.5 MILLION times .. and we announced significant collaborations with other open source projects
Cc @javamuffinztx @seqradev @pentestkit
#zaproxy #appsec

[Royce Davis @filero_suave]

@zaproxy @javamuffinztx @seqradev @pentestkit Like half a million of those runs were me 😂

[Zed Attack Proxy @zaproxy]

This is huge!
https://t.co/NJhXgltA5D
OWASP PTK massively increases ZAP’s browser side testing capabilities .. and automation is up next!
Many thanks to @pentestkit for this great integration.
#zaproxy #owasp #appsec

[pentestkit @pentestkit]

With OWASP PTK 9.8.0 and the ZAP PTK add-on 0.3.0, findings from PTK can now show up in ZAP as native Alerts.
https://t.co/reS5mojceu

[pentestkit @pentestkit]

OWASP PTK + ZAP

[pentestkit @pentestkit]

PTK 9.8.0 with auto-discovery is out and I tested it on https://t.co/X9AYVTCFMN

10 XSS first.

Same workflow + auto-discovery.
32 high-severity findings across XSS + SQLi.
Video: https://t.co/lMD94DkBAY
#AppSec #BugBounty #XSS #SQLi #DAST

[pentestkit @pentestkit]

𝗢𝗪𝗔𝗦𝗣 𝗣𝗧𝗞 𝟵.𝟳.𝟬 is out for Chromium and Firefox
This release is all about improving the 𝗯𝘂𝗴 𝗯𝗼𝘂𝗻𝘁𝘆 𝘂𝘀𝗲𝗿 𝗲𝘅𝗽𝗲𝗿𝗶𝗲𝗻𝗰𝗲.
See how SAST can find hidden routes!

[pentestkit @pentestkit]

𝗢𝗪𝗔𝗦𝗣 𝗣𝗧𝗞 𝟵.𝟲.𝟬 𝗶𝘀 𝗼𝘂𝘁 - a reporting + correlation focused release.

This version is all about turning scan output into something you can actually share, triage, and act on.

https://t.co/Freljr6vZD

[pentestkit @pentestkit]

Reposting this write-up - if you try the add-on, break it (politely) and tell me what you’d like to see next. Bugs, issues, and reviews genuinely help.
https://t.co/J3tCD0whLZ

[pentestkit @pentestkit]

𝗭𝗔𝗣 + 𝗢𝗪𝗔𝗦𝗣 𝗣𝗧𝗞 as a browser-based AppSec tool is a pretty powerful combo.
I’m really excited to share a major milestone for OWASP PTK: the 𝗢𝗪𝗔𝗦𝗣 𝗣𝗧𝗞 𝗮𝗱𝗱-𝗼𝗻 𝗳𝗼𝗿 𝗭𝗔𝗣 is now released.
https://t.co/wLvk4NNhpo

[pentestkit @pentestkit]

PWASP PTK 9.5.0 has been released:
JWT attacks improved: fixed false positives for alg=none checks and better handling of public/unauthenticated endpoints.
SPA attacks support: improved attack flow for modern single-page applications.
UI performance and bug fixes.

[pentestkit @pentestkit]

OWASP PTK v.9.1.0/1 has just been released with a full house appsec tools:
- DAST (Dynamic Application Security Testing)
- IAST (Interactive Application Security Testing)
- SAST (Static Application Security Testing)
- SCA (Software Composition Analysis)

[pentestkit @pentestkit]

Meet first in class in-browser IAST agent for JavaScript!
In OWASP PTK v9, we’ve introduced an integrated IAST capability to help surface client-side issues immediately:
*Taint-Flow Visibility
*Contextual Findings
*Zero-Configuration Deployment

[pentestkit @pentestkit]

The OWASP PTK extension will be included as one of the default system-level Firefox pentesting extensions in the upcoming major release of Athena OS, which will transition from Arch to a Fedora-based environment.
See https://t.co/Va3iYZPbNE

[TheSecMaster @TheSecMaster1]

🔰5 BEST CHROME EXTENSIONS FOR HACKERS🔰

1. Tamper Data

The Tamper Data extension (https://t.co/HB2FIoCXBl) provides such functionalities. It is an essential tool that supports ethical hacking processes through the Chrome web browser.

2. Hackbar

The HackBar extension (https://t.co/LanIY5AytG) assists in hash generation, XSS queries, decoding, encoding, and SQL functions other than an interface. The extension helps users easily copy, read, and request URLs,

3. Open the Port Check Tool

The Open Port Check Tool extension (https://t.co/u9vl5WTXJ2) helps hackers detect if a computer has any open ports. The extension alerts users to turn off all unused ports to reduce the possibility of an intrusion.

4. Request Maker

Hackers find the Request Maker extension (https://t.co/RmJZszpsmx) useful when conducting fuzz tests to detect security vulnerabilities and coding errors. The Request Maker tool simplifies the process since it is designed as a core pen-testing tool.

5. Penetration Testing Kit

The Chrome-based Penetration Testing Kit (https://t.co/THFffXCLAt) contains a bundle of useful pen-testing exercises for professional, ethical hackers. The extension provides an interface through which users can view and send responses and request information.

[pentestkit @pentestkit]

OWASP PTK v 8.9 with cheat sheets for XSS and SQL just released. All your favorite attack payloads in one place - from XSS WAF bypass to SQL injections for MySQL/MSSQL/Oracle/PostgreSQL.
Sometimes appsec is just one click in your browser.