Offensive Web Testing Framework

OWASP OWTF makes security assessments as efficient as possible by automating the manual, uncreative part of penetration testing while still supporting OWASP, NIST, and PTES methodologies out of the box.

Get OWTF on GitHub↗Read the documentation

For current work, use the develop branch. The latest tagged release is v2.6.0 from March 2022.

OWASP

Flagship project

100+

Plugins and integrations

Interactive

Reporting after every scan

Quick startTerminal 
git clone https://github.com/owtf/owtf.git
cd owtf
make compose-safe

# Open http://localhost:8019

Responsive web interface

Configure and monitor OWTF through the browser-based UI included with the project.

Plugin-driven automation

Extend OWTF by adding plugins that orchestrate your favourite assessment tools and workflows.

Docker-based setup

Use the project’s Docker Compose workflow to run OWTF’s services in a consistent local environment.

Capabilities

Automation that respects human-driven testing.

OWTF focuses on automating repetitive work while keeping analysts in control. The project is built around extensible plugins and tooling support maintained by the community.

Easy to use

Use the built-in web UI to configure and monitor assessments, and access RESTful APIs for all core capabilities.

  • Responsive management interface
  • REST APIs for automation

Unites popular tools

OWTF scrubs plugin output to gather as many URLs as possible and lets you scan by aggression level across your toolkit.

  • Plugin-based orchestration
  • Multiple aggression levels

Reproducible Docker setup

Build and run the application stack with Docker Compose, keeping the required services and dependencies together.

  • Docker support
  • Cross-platform workflow

Standards & workflow

Keep methodology, automation, and reporting in sync.

From methodology alignment to evidence delivery, OWTF keeps the flow of a web security assessment organised without sacrificing the analyst’s judgement.

Support established testing standards

OWTF provides out-of-the-box support for the OWASP Web Security Testing Guide as well as NIST and PTES methodologies, helping teams align with recognised practices.

  • OWASP Web Security Testing Guide coverage
  • NIST-aligned workflows
  • PTES-ready profiles

Automate repeatable tasks

Gather URLs by scrubbing plugin output, trigger scans by aggression level, and extend coverage by adding new tools through plugins.

  • URL harvesting from tools
  • Aggression-level based scans
  • Extensible plugin system

Report findings with context

OWTF concludes each scan with a comprehensive interactive report so teams can explore evidence and prioritise remediation.

  • Interactive reporting
  • Evidence tracking
  • Team-ready summaries

Get started

Run OWTF today.

Clone the current source, start the local Docker Compose stack, and open the web UI. Only test systems you own or have explicit permission to assess.

Browse documentation→
git clone https://github.com/owtf/owtf.git cd owtf

Clone the official repository and enter the owtf directory.

make compose-safe

Build and start the supported Docker Compose environment.

http://localhost:8019

Open the web interface in your browser after the services are ready.