Cross-browser extension Penetration Testing Kit
- Tweets 73
- Following 7
- Followers 81
- Likes 11
Pinned Tweet
@browserbase vs @browserless?
Both platforms are strong, and both can add OWASP PTK as a security layer. See screenshots for some early experiments.
1
33
A major milestone: OWASP PTK has been approved for OWASP Production level. ๐
From a browser extension to DAST, SAST, IAST, SCA, automation, GitHub Actions and ZAP integration.
Thanks to everyone who tested, contributed and supported PTK.
owasp.org/projects/penetratiโฆ
1
3
278
Browser automation already has the real application session: authentication, SPA state, loaded JavaScript and API traffic.
PTK Auto runs DAST, SAST, IAST and SCA inside that session while the existing test remains in control.
Cloud-provider support:
github.com/ptklabs/ptk-agentโฆ
1
71
OWASP PTK 9.9.9 is out.
New: macro-guided scans. Import or record a browser journey, replay it deterministically, and collect DAST, IAST, SAST & SCA evidence across the flow.
Plus better SPA/tab coverage and security hardening.
pentestkit.co.uk/release_notโฆ
1
104
Weโve released OWASP PTK Security Scan on GitHub Marketplace.
Run DAST, IAST, SAST and SCA in Chromium, upload SARIF to GitHub Code Scanning, and fail CI by severity.
Browser-side security testing on every PR.
github.com/marketplace/actioโฆ
1
3
217
Weโve released PTK Auto for OWASP PTK automation.
Run browser-side security testing from CLI, CI/CD, Playwright, Puppeteer, Selenium and Cypress workflows.
Browser testing + security testing in the same automation flow.
See pentestkit.co.uk/install.htmโฆ
#OWASP #AppSec #DevSecOps
1
1
1
74
I'm speaking at @bsidesbelfast!
๐ข๐ช๐๐ฆ๐ฃ ๐ฃ๐ง๐: ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐ง๐ฒ๐๐๐ถ๐ป๐ด ๐ช๐ต๐ฒ๐ฟ๐ฒ ๐๐ต๐ฒ ๐๐ฟ๐ผ๐๐๐ฒ๐ฟ ๐๐ ๐๐ต๐ฒ ๐ฆ๐ผ๐๐ฟ๐ฐ๐ฒ ๐ผ๐ณ ๐ง๐ฟ๐๐๐ต
3
3
211
Making ๐ข๐ช๐๐ฆ๐ฃ ๐ฃ๐ง๐ easier to integrate with browser automation platforms like @browserstack .
If you already run browser tests with ๐ฆ๐ฒ๐น๐ฒ๐ป๐ถ๐๐บ, ๐ฃ๐น๐ฎ๐๐๐ฟ๐ถ๐ด๐ต๐, ๐ฃ๐๐ฝ๐ฝ๐ฒ๐๐ฒ๐ฒ๐ฟ, or ๐๐๐ฝ๐ฟ๐ฒ๐๐, why not add a security testing layer into the same workflow?
1
5
476
Great for anyone interested in browser-side security testing, SAST, and modern web application security.
piped.video/uUUAm4U9tA8
1
1
215
If you use @browserling for cross-browser testing, you can also add a lightweight security testing layer with OWASP PTK. Watch the demo.
2
2
260
pentestkit retweeted
ZAP now has a dedicated OWASP PTK active scan rule, so you can run the PTK rules in the ZAP active scanner.
Check out the dramatic improvement in the scores vs Google Firing Range!
zaproxy.org/blog/2026-06-05-โฆ
#zaproxy #owaspptk #appsec
6
5
2,027
ZAP and PTK - Phase 2.
zaproxy.org/blog/2026-06-05-โฆ
1
2
249
๐ข๐ช๐๐ฆ๐ฃ ๐ฃ๐ง๐ ๐ถ๐ ๐ป๐ผ๐ ๐ฎ๐๐ฎ๐ถ๐น๐ฎ๐ฏ๐น๐ฒ ๐ฎ๐ ๐ฎ๐ป ๐ป๐ฝ๐บ ๐ฝ๐ฎ๐ฐ๐ธ๐ฎ๐ด๐ฒ
Instead of treating browser security testing as a separate manual activity, teams can now run PTK-backed scans as part of automation.
npmjs.com/package/pentestkit
25
pentestkit retweeted
Blog: Automating OWASP PTK with ZAP (Phase 1)
You can now automate @OWASP @pentestkit using ZAP
zaproxy.org/blog/2026-05-06-โฆ
#zaproxy #owasp #appsec
9
18
3,475
I wrote a scenario like a prompt, hit runโฆ and Codex just did the job.
Playwright is driving the browser.
OWASP PTK is turning it into real DAST/IAST findings.
It even solved a math captcha on its own.
This is what crawling should look like.
piped.video/UjjrxENjyEg
88
pentestkit retweeted
Blog: ZAP Updates for March:
zaproxy.org/blog/2026-04-03-โฆ
ZAP was started 9.5 MILLION times .. and we announced significant collaborations with other open source projects
Cc @javamuffinztx @seqradev @pentestkit
#zaproxy #appsec
1
10
24
1,393
pentestkit retweeted
This is huge!
zaproxy.org/blog/2026-04-01-โฆ
OWASP PTK massively increases ZAPโs browser side testing capabilities .. and automation is up next!
Many thanks to @pentestkit for this great integration.
#zaproxy #owasp #appsec
1
12
24
1,541
With OWASP PTK 9.8.0 and the ZAP PTK add-on 0.3.0, findings from PTK can now show up in ZAP as native Alerts.
zaproxy.org/blog/2026-04-01-โฆ
4
5
2,029
PTK 9.8.0 with auto-discovery is out and I tested it on burpbountylab.com/
10 XSS first.
Same workflow + auto-discovery.
32 high-severity findings across XSS + SQLi.
Video: piped.video/bdC-hZ79kDk
#AppSec #BugBounty #XSS #SQLi #DAST
2
103