owasp-testing-guide.json

{
  "checklist": {
    "Settings": "",
    "Functionality": {
      "01: Information Gathering: OTG-INFO": {
        "description": "",
        "tests": {
          "OTG-INFO-001 Conduct Search Engine Discovery/Reconnaissance for Information Leakage": {
            "description": "Test Objectives: To understand what sensitive design and configuration information of the application/system/organization is exposed both directly (on the organization's website) or indirectly (on a third party website).",
            "resources": ["https://www.owasp.org/index.php/Conduct_search_engine_discovery/reconnaissance_for_information_leakage_(OTG-INFO-001)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INFO-002 Fingerprint Web Server": {
            "description": "Test Objectives: Find the version and type of a running web server to determine known vulnerabilities and the appropriate exploits to use during testing.",
            "resources": ["https://www.owasp.org/index.php/Fingerprint_Web_Server_(OTG-INFO-002)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INFO-003 Review Webserver Metafiles for Information Leakage": {
            "description": "Test Objectives: 1. Information leakage of the web application's directory or folder path(s). 2. Create the list of directories that are to be avoided by Spiders, Robots, or Crawlers.",
            "resources": ["https://www.owasp.org/index.php/Review_Webserver_Metafiles_for_Information_Leakage_(OTG-INFO-003)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INFO-004 Enumerate Applications on Webserver": {
            "description": "Test Objectives: Enumerate the applications within scope that exist on a web server.",
            "resources": ["https://www.owasp.org/index.php/Enumerate_Applications_on_Webserver_(OTG-INFO-004)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INFO-005 Review Webpage Comments and Metadata for Information Leakage": {
            "description": "Test Objectives: Review webpage comments and metadata to better understand the application and to find any information leakage.",
            "resources": ["https://www.owasp.org/index.php/Review_webpage_comments_and_metadata_for_information_leakage_(OTG-INFO-005)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INFO-006 Identify Application Entry Points": {
            "description": "Test Objectives: Understand how requests are formed and typical responses from the application.",
            "resources": ["https://www.owasp.org/index.php/Identify_application_entry_points_(OTG-INFO-006)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INFO-007 Map Execution Paths Through Application": {
            "description": "Test Objectives: Map the target application and understand the principal workflows.",
            "resources": ["https://www.owasp.org/index.php/Map_execution_paths_through_application_(OTG-INFO-007)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INFO-008 Fingerprint Web Application Framework": {
            "description": "Test Objectives: To define type of used web framework so as to have a better understanding of the security testing methodology.",
            "resources": ["https://www.owasp.org/index.php/Fingerprint_Web_Application_Framework_(OTG-INFO-008)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INFO-009 Fingerprint Web Application": {
            "description": "Test Objectives: Identify the web application and version to determine known vulnerabilities and the appropriate exploits to use during testing.",
            "resources": ["https://www.owasp.org/index.php/Fingerprint_Web_Application_(OTG-INFO-009)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INFO-010 Map Application Architecture": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Map_Application_Architecture_(OTG-INFO-010)"],
            "bugs": [],
            "notes": ""
          }
        }
      },
      "02: Configuration and Deployment Management Testing: OTG-CONFIG": {
        "description": "",
        "tests": {
          "OTG-CONFIG-001 Test Network/Infrastructure Configuration": {
            "description": "Test Objectives: Map the infrastructure supporting the application and understand how it affects the security of the application.",
            "resources": ["https://www.owasp.org/index.php/Test_Network/Infrastructure_Configuration_(OTG-CONFIG-001)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CONFIG-002 Test Application Platform Configuration": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_Application_Platform_Configuration_(OTG-CONFIG-002)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CONFIG-003 Test File Extensions Handling for Sensitive Information": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_File_Extensions_Handling_for_Sensitive_Information_(OTG-CONFIG-003)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CONFIG-004 Review Old, Backup and Unreferenced Files for Sensitive Information": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Review_Old,_Backup_and_Unreferenced_Files_for_Sensitive_Information_(OTG-CONFIG-004)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CONFIG-005 Enumerate Infrastructure and Application Admin Interfaces": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Enumerate_Infrastructure_and_Application_Admin_Interfaces_(OTG-CONFIG-005)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CONFIG-006 Test HTTP Methods": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_HTTP_Methods_(OTG-CONFIG-006)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CONFIG-007 Test HTTP Strict Transport Security": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_HTTP_Strict_Transport_Security_(OTG-CONFIG-007)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CONFIG-008 Test RIA Cross Domain Policy": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_RIA_cross_domain_policy_(OTG-CONFIG-008)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CONFIG-009 Test File Permission": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_File_Permission_(OTG-CONFIG-009)"],
            "bugs": [],
            "notes": ""
          }
        }
      },
      "03: Identity Management Testing: OTG-IDENT": {
        "description": "",
        "tests": {
          "OTG-IDENT-001 Test Role Definitions": {
            "description": "Test Objectives: Validate the system roles defined within the application sufficiently define and separate each system and business role to manage appropriate access to system functionality and information.",
            "resources": ["https://www.owasp.org/index.php/Test_Role_Definitions_(OTG-IDENT-001)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-IDENT-002 Test User Registration Process": {
            "description": "Test Objectives: 1. Verify that the identity requirements for user registration are aligned with business and security requirements. 2. Validate the registration process.",
            "resources": ["https://www.owasp.org/index.php/Test_User_Registration_Process_(OTG-IDENT-002)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-IDENT-003 Test Account Provisioning Process": {
            "description": "Test Objectives: Verify which accounts may provision other accounts and of what type.",
            "resources": ["https://www.owasp.org/index.php/Test_Account_Provisioning_Process_(OTG-IDENT-003)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-IDENT-004 Testing for Account Enumeration and Guessable User Account": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Account_Enumeration_and_Guessable_User_Account_(OTG-IDENT-004)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-IDENT-005 Testing for Weak or Unenforced Username Policy": {
            "description": "Test Objectives: Determine whether a consistent account name structure renders the application vulnerable to account enumeration. Determine whether the application's error messages permit account enumeration.",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Weak_or_unenforced_username_policy_(OTG-IDENT-005)"],
            "bugs": [],
            "notes": ""
          }
        }
      },
      "04: Authentication Testing: OTG-AUTHN": {
        "description": "",
        "tests": {
          "OTG-AUTHN-001 Testing for Credentials Transported over an Encrypted Channel": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Credentials_Transported_over_an_Encrypted_Channel_(OTG-AUTHN-001)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-AUTHN-002 Testing for Default Credentials": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_default_credentials_(OTG-AUTHN-002)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-AUTHN-003 Testing for Weak Lock Out Mechanism": {
            "description": "Test Objectives: 1. Evaluate the account lockout mechanism's ability to mitigate brute force password guessing. 2. Evaluate the unlock mechanism's resistance to unauthorized account unlocking.",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Weak_lock_out_mechanism_(OTG-AUTHN-003)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-AUTHN-004 Testing for Bypassing Authentication Schema": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Bypassing_Authentication_Schema_(OTG-AUTHN-004)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-AUTHN-005 Testing for Vulnerable Remember Password": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-AUTHN-006 Testing for Browser Cache Weakness": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Browser_cache_weakness_(OTG-AUTHN-006)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-AUTHN-007 Testing for Weak Password Policy ": {
            "description": "Test Objectives: Determine the resistance of the application against brute force password guessing using available password dictionaries by evaluating the length, complexity, reuse and aging requirements of passwords.",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Weak_password_policy_(OTG-AUTHN-007)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-AUTHN-008 Testing for Weak Security Question/Answer": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Weak_security_question/answer_(OTG-AUTHN-008)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-AUTHN-009 Testing for Weak Password Change or Reset Functionalities": {
            "description": "Test Objectives: 1. Determine the resistance of the application to subversion of the account change process allowing someone to change the password of an account. 2. Determine the resistance of the passwords reset functionality against guessing or bypassing.",
            "resources": ["https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-AUTHN-010 Testing for Weaker Authentication in Alternative Channel": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Weaker_authentication_in_alternative_channel_(OTG-AUTHN-010)"],
            "bugs": [],
            "notes": ""
          }
        }
      },
      "05: Authorization Testing: OTG-AUTHZ": {
        "description": "",
        "tests": {
          "OTG-AUTHZ-001 Testing Directory Traversal/File Include": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_Directory_traversal/file_include_(OTG-AUTHZ-001)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-AUTHZ-002 Testing for Bypassing Authorization Schema": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Bypassing_Authorization_Schema_(OTG-AUTHZ-002)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-AUTHZ-003 Testing for Privilege Escalation": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Privilege_escalation_(OTG-AUTHZ-003)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-AUTHZ-004 Testing for Insecure Direct Object References": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Insecure_Direct_Object_References_(OTG-AUTHZ-004)"],
            "bugs": [],
            "notes": ""
          }
        }
      },
      "06: Session Management Testing: OTG-SESS": {
        "description": "",
        "tests": {
          "OTG-SESS-001 Testing for Session Management Schema": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Session_Management_Schema_(OTG-SESS-001)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-SESS-002 Testing for Cookies Attributes": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_cookies_attributes_(OTG-SESS-002)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-SESS-003 Testing for Session Fixation": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Session_Fixation_(OTG-SESS-003)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-SESS-004 Testing for Exposed Session Variables": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Exposed_Session_Variables_(OTG-SESS-004)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-SESS-005 Testing for CSRF": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_CSRF_(OTG-SESS-005)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-SESS-006 Testing for Logout Functionality": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_logout_functionality_(OTG-SESS-006)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-SESS-007 Test Session Timeout": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_Session_Timeout_(OTG-SESS-007)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-SESS-008 Testing for Session Puzzling": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Session_puzzling_(OTG-SESS-008)"],
            "bugs": [],
            "notes": ""
          }
        }
      },
      "07: Input Validation Testing: OTG-INPVAL": {
        "description": "",
        "tests": {
          "OTG-INPVAL-001 Testing for Reflected Cross Site Scripting": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Reflected_Cross_site_scripting_(OTG-INPVAL-001)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-002 Testing for Stored Cross Site Scripting": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Stored_Cross_site_scripting_(OTG-INPVAL-002)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-003 Testing for HTTP Verb Tampering": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_HTTP_Verb_Tampering_(OTG-INPVAL-003)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-004 Testing for HTTP Parameter Pollution": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-005 Testing for SQL Injection": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005)","https://www.owasp.org/index.php/Testing_for_Oracle","https://www.owasp.org/index.php/Testing_for_MySQL","https://www.owasp.org/index.php/Testing_for_SQL_Server","https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL","https://www.owasp.org/index.php/Testing_for_MS_Access","https://www.owasp.org/index.php/Testing_for_NoSQL_injection"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-006 Testing for LDAP Injection": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_LDAP_Injection_(OTG-INPVAL-006)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-007 Testing for ORM Injection": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_ORM_Injection_(OTG-INPVAL-007)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-008 Testing for XML Injection": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_XML_Injection_(OTG-INPVAL-008)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-009 Testing for SSI Injection": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_SSI_Injection_(OTG-INPVAL-009)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-010 Testing for XPath Injection": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_XPath_Injection_(OTG-INPVAL-010)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-011 Testing for IMAP/SMTP Injection": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_IMAP/SMTP_Injection_(OTG-INPVAL-011)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-012 Testing for Code Injection": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Code_Injection_(OTG-INPVAL-012)","https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion","https://www.owasp.org/index.php/Testing_for_Remote_File_Inclusion"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-013 Testing for Command Injection": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Command_Injection_(OTG-INPVAL-013)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-014 Testing for Buffer Overflow": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Buffer_Overflow_(OTG-INPVAL-014)","https://www.owasp.org/index.php/Testing_for_Heap_Overflow","https://www.owasp.org/index.php/Testing_for_Stack_Overflow","https://www.owasp.org/index.php/Testing_for_Format_String"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-015 Testing for Incubated Vulnerability": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Incubated_Vulnerability_(OTG-INPVAL-015)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-016 Testing for HTTP Splitting/Smuggling": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_HTTP_Splitting/Smuggling_(OTG-INPVAL-016)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-INPVAL-017 Testing for HTTP Incoming Requests": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_HTTP_Incoming_requests_(OTG-INPVAL-017)"],
            "bugs": [],
            "notes": ""
          }
        }
      },
      "08: Testing for Error Handling: OTG-ERR": {
        "description": "",
        "tests": {
          "OTG-ERR-001 Testing for Error Codes": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Error_Code_(OTG-ERR-001)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-ERR-002 Testing for Stack Traces": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Stack_Traces_(OTG-ERR-002)"],
            "bugs": [],
            "notes": ""
          }
        }
      },
      "09: Testing for weak Cryptography: OTG-CRYPST": {
        "description": "",
        "tests": {
          "OTG-CRYPST-001 Testing for Weak SSL/TLS Ciphers, Insufficient Transport Layer Protection": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Weak_SSL/TLS_Ciphers,_Insufficient_Transport_Layer_Protection_(OTG-CRYPST-001)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CRYPST-002 Testing for Padding Oracle": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Padding_Oracle_(OTG-CRYPST-002)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CRYPST-003 Testing for Sensitive Information Sent via Unencrypted Channels": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Sensitive_information_sent_via_unencrypted_channels_(OTG-CRYPST-003)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CRYPST-004 Testing for Weak Encryption": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Weak_Encryption_(OTG-CRYPST-004)"],
            "bugs": [],
            "notes": ""
          }
        }
      },
      "10: Business Logic Testing: OTG-BUSLOGIC": {
        "description": "",
        "tests": {
          "OTG-BUSLOGIC-001 Test Business Logic Data Validation": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_business_logic_data_validation_(OTG-BUSLOGIC-001)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-BUSLOGIC-002 Test Ability to Forge Requests": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_Ability_to_forge_requests_(OTG-BUSLOGIC-002)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-BUSLOGIC-003 Test Integrity Checks": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_integrity_checks_(OTG-BUSLOGIC-003)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-BUSLOGIC-004 Test for Process Timing": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_for_Process_Timing_(OTG-BUSLOGIC-004)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-BUSLOGIC-005 Test Number of Times a Function Can Be Used Limits": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_number_of_times_a_function_can_be_used_limits_(OTG-BUSLOGIC-005)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-BUSLOGIC-006 Testing for the Circumvention of Work Flows": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_the_Circumvention_of_Work_Flows_(OTG-BUSLOGIC-006)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-BUSLOGIC-007 Test Defenses Against Application Misuse": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_defenses_against_application_mis-use_(OTG-BUSLOGIC-007)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-BUSLOGIC-008 Test Upload of Unexpected File Types": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_Upload_of_Unexpected_File_Types_(OTG-BUSLOGIC-008)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-BUSLOGIC-009 Test Upload of Malicious Files": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_Upload_of_Malicious_Files_(OTG-BUSLOGIC-009)"],
            "bugs": [],
            "notes": ""
          }
        }
      },
      "11: Client Side Testing: OTG-CLIENT": {
        "description": "",
        "tests": {
          "OTG-CLIENT-001 Testing for DOM-based Cross Site Scripting": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_DOM-based_Cross_site_scripting_(OTG-CLIENT-001)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CLIENT-002 Testing for JavaScript Execution": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_JavaScript_Execution_(OTG-CLIENT-002)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CLIENT-003 Testing for HTML Injection": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_HTML_Injection_(OTG-CLIENT-003)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CLIENT-004 Testing for Client Side URL Redirect": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Client_Side_URL_Redirect_(OTG-CLIENT-004)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CLIENT-005 Testing for CSS Injection": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_CSS_Injection_(OTG-CLIENT-005)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CLIENT-006 Testing for Client Side Resource Manipulation": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Client_Side_Resource_Manipulation_(OTG-CLIENT-006)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CLIENT-007 Test Cross Origin Resource Sharing": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_Cross_Origin_Resource_Sharing_(OTG-CLIENT-007)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CLIENT-008 Testing for Cross Site Flashing": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Cross_site_flashing_(OTG-CLIENT-008)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CLIENT-009 Testing for Clickjacking": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_for_Clickjacking_(OTG-CLIENT-009)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CLIENT-010 Testing WebSockets": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Testing_WebSockets_(OTG-CLIENT-010)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CLIENT-011 Test Web Messaging": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_Web_Messaging_(OTG-CLIENT-011)"],
            "bugs": [],
            "notes": ""
          },
          "OTG-CLIENT-012 Test Local Storage": {
            "description": "",
            "resources": ["https://www.owasp.org/index.php/Test_Local_Storage_(OTG-CLIENT-012)"],
            "bugs": [],
            "notes": ""
          }
        }
      }
    }
  }
}