OWASP WSTG coverage map
Pro. For “which OWASP tests does it cover?”Penthera maps its probes to the OWASP Web Security Testing Guide (WSTG) v4.2. The mapping lives in
lib/owasp-wstg.js, and this page follows it. Each scan report includes a coverage table built from the probes that actually ran.
A mapped WSTG ID means a probe touches that test area. It does not mean the probe runs every test case the guide describes for it.
Coverage by profile
Probe to WSTG mapping
WSTG categories not covered
Penthera does not automate these WSTG areas, or covers them only in part:Finding category to WSTG
When it reports a finding, Penthera tags it with relevant WSTG IDs in JSON (finding.wstg[]), SARIF (properties.tags), and Markdown reports.
Penthera also adds tags from the probe that produced a finding and from keywords in its title, so a finding can carry more IDs than its category lists here.
References
- OWASP WSTG on GitHub
- Penthera implementation:
lib/owasp-wstg.js - Report integration:
src/report/markdown.js,src/reporter.js