Release Notes
v1.0 — Web Security Testing Guide Knowledge Base
Released: 2026-02-22
Overview
Initial release of the AutoPentest AI knowledge base, providing complete OWASP Web Security Testing Guide (WSTG v4.2) coverage as structured, machine-readable test case files for automated penetration testing.
What's Included
WSTG Knowledge Base — 109 Test Cases Across 12 Categories
Full coverage of the OWASP WSTG v4.2, organized into per-category directories under knowledge-base/web-security-testing-guide/:
| Category | Code | Tests |
|---|---|---|
| Information Gathering | INFO | 10 |
| Configuration and Deployment Management | CONF | 14 |
| Identity Management | IDNT | 5 |
| Authentication | ATHN | 11 |
| Authorization | ATHZ | 5 |
| Session Management | SESS | 11 |
| Input Validation | INPV | 20 |
| Error Handling | ERRH | 2 |
| Cryptography | CRYP | 4 |
| Business Logic | BUSL | 10 |
| Client-Side Testing | CLNT | 14 |
| API Testing | APIT | 3 |
Total: 109 test cases
Test Case Format
Each test file (WSTG-<CODE>-<NUMBER>.md) includes:
- YAML frontmatter —
id,title,category,severity_range,owasp_ref - Summary — what the test covers and why it matters
- Test Objectives — specific goals for the test
- Prerequisites — required access, tools, or conditions
- Test Steps — step-by-step procedure with CLI actions using
docker exec autopentest-tools - Payloads — ready-to-use test payloads per vulnerability class
- Detection Criteria — what constitutes a positive finding
- Severity Assessment — mapping of conditions to severity ratings
- Remediation — developer-facing fix guidance
- References — OWASP source links and related resources
MCP Server Integration
The test cases are served via the wstg-pentest MCP server, which exposes the knowledge base through Claude Code tools (get_wstg_test, list_tests_in_category, search_wstg, get_test_payloads).