search

OWASP / wstg

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.
https://owasp.org/www-project-web-security-testing-guide/
Creative Commons Attribution Share Alike 4.0 International
6.93k stars 1.29k forks source link

Introduction - Add "Disable Compensating Controls For Testers" #1131

Closed swgee closed 4 months ago

swgee commented 4 months ago

Add a header to the introduction page recommending disabling compensating controls such as a WAF. Testers can use this section to provide product teams with an authoritative resource on how to set up a penetration test effectively.

There is a widespread belief that penetration tests should be conducted in a black-box setting as this is more realistic. While true, the goal of this PR is to help educate that white-box penetration tests without compensating controls are much more effective in securing an application.

github-actions[bot] commented 4 months ago

The following links are broken: FILE:document/2-Introduction/README.md [✖] https://www.it-cisq.org/the-cost-of-poor-software-quality-in-the-us-a-2020-report/ → Status: 403 [✖] https://www.ffiec.gov/cyberassessmenttool.htm → Status: 403

kingthorin commented 4 months ago

Link check 403s are false positive.

github-actions[bot] commented 4 months ago

The following links are broken: FILE:document/2-Introduction/README.md [✖] https://www.it-cisq.org/the-cost-of-poor-software-quality-in-the-us-a-2020-report/ → Status: 403 [✖] https://www.ffiec.gov/cyberassessmenttool.htm → Status: 403