owtf/owtfModular penetration testing framework integrating multiple tools for automated web application security assessment, aligned with OWASP Testing Guide, PTES, and NIST standards.
OWASP OWTF helps penetration testers stay efficient and aligned with security standards such as the OWASP Web Security Testing Guide, the OWASP Top 10, PTES, and NIST so that they have more time to:
The tool is highly configurable, and anyone can create simple plugins or add new tests in configuration files without prior development experience.
Note OWTF is not a silver bullet. Understanding and experience are still required to interpret tool output correctly and decide where to investigate further in order to demonstrate impact.
Docker Compose is the supported way to run OWTF. It keeps the Python, frontend, PostgreSQL, and security-tool dependencies isolated from the host system.
Install Docker with the Compose plugin, then run:
git clone https://github.com/owtf/owtf.git
cd owtf
make compose-safe
When the services are ready, open http://localhost:8019.
| Service | Address |
|---|---|
| Web interface | http://localhost:8019 |
| Backend API | http://localhost:8009 |
| Intercepting proxy | localhost:8008 |
Press Ctrl+C in the Compose terminal to stop OWTF. Native host installation is intended for contributors and is not a
supported end-user installation path; see CONTRIBUTING.md for the development workflow.
Important Only scan systems you own or are explicitly authorised to test.
Check out LICENSE.
Check out the Code of Conduct.
#project-owtf