Web Application Pentest Checklist

Document all in-scope and out-of-scope assets including third-party integrations.

Ensure legal authorization covers all testing activities including automated scanning.

Confirm whether testing will be conducted against production or a mirrored environment.

Document escalation procedures in case of service disruption or critical findings.

Gather information about frameworks, languages, and infrastructure in use.

Use tools like Subfinder, Amass, and certificate transparency logs.

Use Gobuster, Feroxbuster, or ffuf to discover hidden endpoints, backup files, and admin panels.

Fingerprint technologies using Wappalyzer, WhatWeb, or response header analysis.

Check for exposed paths, disallowed directories, and security contact information.

Use Burp Suite Spider or ZAP to build a comprehensive site map.

Analyze JavaScript bundles and network traffic for undocumented API calls.

Use both manual payloads and automated tools like sqlmap on GET, POST, and cookie parameters.

Inject XSS payloads into form fields, URL parameters, headers, and dynamic content areas.

Test for brute-force protections, credential stuffing resilience, default credentials, and password policy enforcement.

Verify session tokens are regenerated after login, cookies have Secure and HttpOnly flags, and sessions expire appropriately.

Attempt to access other users' resources by manipulating object identifiers in URLs and API calls.

Probe URL parameters, file imports, and webhook configurations for internal network access.

Confirm anti-CSRF tokens are present and validated on all forms and AJAX requests.

Test horizontal and vertical privilege escalation by accessing endpoints belonging to higher-privileged roles.

Upload web shells, polyglot files, and bypass extension/MIME type restrictions.

Chain discovered vulnerabilities to demonstrate real-world impact such as data exfiltration.

Bypass pricing logic, manipulate multi-step workflows, and test race conditions.

Check for missing X-Frame-Options, HSTS, CSP, and other security headers.

Include screenshots, HTTP request/response pairs, and reproduction steps.

Assign severity ratings based on exploitability, impact, and affected asset criticality.

Include specific code fixes, configuration changes, and reference documentation.

Summarize overall risk posture, critical findings, and prioritized remediation roadmap.

Remove uploaded files, test data, and any accounts created during the engagement.