OWASP PTK: Security Testing Where the Browser Is the Source of Truth - Denis Podgurskii

Modern web applications are no longer simple request-and-response systems. They are authenticated, JavaScript-heavy, stateful, SPA-driven, and full of behaviour that only appears after a real user follows the right path through the browser. Traditional scanners and proxy-based workflows are powerful, but they can lose important context: the current user session, DOM state, client-side routes, tokens, storage, runtime JavaScript behaviour, and the exact sequence of actions that produced a finding. This talk introduces OWASP PenTest Kit, a browser-native application security toolkit designed to bring security testing closer to where modern applications actually run. I will explain why PTK exists, the problems it tries to solve, and how browser-based testing can complement established AppSec workflows rather than replace them. The session will cover practical PTK workflows across DAST, SAST, IAST, and browser-driven scanning, showing how testing from inside the browser can help with authenticated flows, single-page applications, client-side code, request inspection, tokens, cookies, and live application behaviour. I will also cover how PTK integrates with OWASP ZAP, combining ZAP’s proxy and traffic visibility with PTK’s in-browser analysis and testing capabilities. The second half of the talk focuses on automation. I will show how PTK can be used beyond manual testing through its npm package, crawler-driven workflows, and support for agent-assisted approaches using tools such as OpenCode and Codex-style automation. The goal is to demonstrate how browser-native testing, crawling, automation, and existing proxy tooling can work together in a repeatable AppSec workflow. Attendees will leave with a practical understanding of where OWASP PTK fits, what problems it is designed to solve, how it can support manual and automated testing, and how browser-native security tooling can improve coverage for modern web applications.