Skip to content

OWASP flagship project · offensive security

Human-led web security testing, without the repetitive work

OWTF coordinates security tools, targets, evidence, and reporting so penetration testers can spend more time reasoning about impact and less time repeating mechanical checks.

Install OWTF Run your first assessment

quick startdocker compose
git clone https://github.com/owtf/owtf.git
cd owtf
make compose-safe

Open http://localhost:8019 when the services are ready.

Use OWTF only with authorization

Only test systems you own or have explicit permission to assess. OWTF can run active security tools that may change data, generate significant traffic, or disrupt a target.

Start with the job you need to do

  • Set up an assessment

    Add targets, separate engagements with sessions, and keep scope visible.

    Targets and sessions →

  • Run security tooling

    Choose passive, semi-passive, or active plugins and monitor their work.

    Plugins →

  • Review evidence

    Explore plugin output, rank findings, add notes, and inspect proxy traffic.

    Results and reporting →

  • Intercept traffic

    Route an authorized browser through OWTF and inspect HTTP or HTTPS flows.

    Intercepting proxy →

How OWTF fits together

OWTF runs as a small local application stack. The browser interface on port 8019 talks to the backend API on port 8009; the intercepting proxy listens on port 8008. PostgreSQL stores sessions, targets, work, and results.

Browser UI :8019 ──► Backend API :8009 ──► PostgreSQL
                              │
                              ├──► workers ──► plugins and tools
                              │
Authorized browser ──► Proxy :8008 ──► target

Read the architecture overview →

Project status

These docs track the active develop branch. The latest tagged release is v2.7.0, published in September 2026. Use the development documentation when working from the current repository.