# OWASP

<span style="background: transparent; margin-top: 0pt; margin-bottom: 0pt;">The "[Open Web Application Security Project](https://owasp.org/)" framework is a community-driven and frequently updated framework used solely to test the security of web applications and services.</span>

<span style="background: transparent; margin-top: 0pt; margin-bottom: 0pt;">The foundation regularly </span>[writes reports](https://owasp.org/www-project-top-ten/2017/)<span style="background: transparent; margin-top: 0pt; margin-bottom: 0pt;"> stating the top ten security vulnerabilities a web application may have, the testing approach, and remediation.</span>

<table class="table table-bordered" id="bkmrk-advantages-disadvant"><tbody><tr><td style="background: #efefef;">**Advantages**</td><td style="background: #efefef;">**Disadvantages**</td></tr><tr><td>Easy to pick up and understand.</td><td>It may not be clear what type of vulnerability a web application has (they can often overlap).  
</td></tr><tr><td>Actively maintained and is frequently updated.  
</td><td>OWASP does not make suggestions to any specific software development life cycles.  
</td></tr><tr><td>It covers all stages of an engagement: from testing to reporting and remediation.  
</td><td>The framework doesn't hold any accreditation such as CHECK.  
</td></tr><tr><td>Specialises in web applications and services.  
</td><td>*Intentionally left blank.*</td></tr></tbody></table>