Security & Compliance
Web Application Penetration Testing Checklist
A practitioner-grade checklist covering every phase of a web application penetration testing engagement, from pre-test scoping to OWASP Top 10 coverage, API testing, and final report requirements.
Web applications are the most exploited attack surface in modern IT environments. Verizon DBIR 2025 confirms that web application attacks are involved in the majority of confirmed data breaches, and IBM's Cost of a Data Breach Report 2025 confirms that customer PII is compromised in 53 percent of all breaches โ the exact data that web applications handle. A structured web application penetration testing engagement finds those vulnerabilities before attackers do. This checklist covers every area a professional engagement must test.
Definition
What is web application penetration testing?
Web application penetration testing is an authorised, manual security assessment of a web application in which a certified tester attempts to exploit vulnerabilities in authentication, input handling, session management, business logic, and API endpoints to demonstrate what a real attacker could access, modify, or steal. It is one scope within the wider VAPT discipline and follows the same engagement lifecycle as any other penetration test, applied specifically to the application layer and structured around the OWASP Web Security Testing Guide.
Before you start
Pre-test requirements checklist
Before testing begins, confirm every item below is in place. Missing any of these will compromise the quality of findings or create legal exposure:
- Written scope agreement signed by both parties โ defines in-scope URLs, subdomains, and APIs
- Testing environment agreed โ production, staging, or dedicated test instance
- Test accounts provisioned โ at minimum one account per privilege level in scope
- WAF and rate-limiting status confirmed โ should it be bypassed or avoided?
- Notification contacts agreed โ who receives an immediate alert if a Critical vulnerability is found
- Backup status verified โ in case any test action causes data modification
- Test methodology agreed โ black-box, grey-box, or white-box
1. Information gathering and reconnaissance
- Enumerate all application entry points: forms, URL parameters, headers, cookies
- Map all application functionality including hidden or unauthenticated paths
- Identify technology stack: web server, framework, database, CDN, WAF
- Review robots.txt, sitemap.xml, and source code comments for sensitive disclosure
- Check for exposed Git repositories, backup files, and admin interfaces
- Identify all third-party integrations and their data flows
2. Authentication testing
- Test for username enumeration via login error messages or response-time differences
- Verify lockout policy after failed login attempts
- Test multi-factor authentication bypass techniques
- Check for password strength enforcement and breach-password detection
- Test OAuth and SSO implementations for token leakage and redirect vulnerabilities
- Verify session token randomness and entropy (minimum 128 bits)
- Test login over HTTP and mixed-content authentication flows
3. Session management
- Confirm session tokens are invalidated on logout
- Test for session fixation vulnerabilities
- Verify session timeout policy is enforced server-side
- Check that session tokens are not transmitted in URLs
- Test for CSRF in all state-changing requests
- Verify SameSite, Secure, and HttpOnly cookie attributes are set correctly
4. Input validation and injection
This checklist maps to the OWASP Top 10 2021 categories: A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable Components, A07 Authentication Failures, A08 Data Integrity Failures, A09 Logging Failures, A10 SSRF. The mapping table further down shows which checklist section covers each category.
- SQL injection in all database-connected parameters โ manual and automated
- NoSQL injection in MongoDB, CouchDB, and other document databases
- Cross-site scripting (XSS) โ reflected, stored, and DOM-based in all input fields
- XML External Entity (XXE) injection in XML-processing endpoints
- Server-Side Request Forgery (SSRF) in URL or file-fetching functionality
- Command injection in any functionality that calls OS commands
- Template injection in server-side rendering functions
- Path traversal in file upload, download, and inclusion features
5. Access control and authorisation
- Test for Insecure Direct Object References (IDOR) by modifying resource identifiers
- Verify horizontal privilege escalation โ can one user access another user's data?
- Verify vertical privilege escalation โ can a low-privilege user access admin functions?
- Test forced browsing to restricted paths
- Check for Mass Assignment vulnerabilities in object creation and update endpoints
6. API security testing
- Document all API endpoints using active crawling and spec files (OpenAPI, Swagger)
- Test authentication on every API endpoint โ not just the login flow
- Test for Broken Object Level Authorization (BOLA) across all API resources
- Test for Broken Function Level Authorization โ can users call admin-only API methods?
- Check for excessive data exposure in API responses
- Test rate limiting and throttling on authentication and sensitive endpoints
- Verify that internal API endpoints are not exposed to external users
7. Business logic testing
- Test purchase flows for price manipulation, quantity bypass, and discount stacking
- Test multi-step workflows for sequence bypass โ can step 3 be reached without step 2?
- Test file upload functions for content-type bypass and malicious file execution
- Test account recovery and password reset flows for predictable tokens or race conditions
- Verify that deleted or deactivated accounts cannot be reactivated by manipulation
OWASP Top 10
OWASP Top 10 2021 mapped to this checklist
A good web application test is judged by coverage, not just findings. The table below maps each OWASP Top 10 2021 category to what you test for it and the checklist section above that covers it, so you can prove the engagement addressed every category โ or see honestly where it did not.
OWASP Top 10 2021 coverage in this checklist
| OWASP Top 10 2021 category | What to test | Covered in section |
|---|---|---|
| A01 Broken Access Control | IDOR, horizontal and vertical privilege escalation, forced browsing, mass assignment | 5. Access control and authorisation |
| A02 Cryptographic Failures | HTTPS enforcement, Secure/HttpOnly/SameSite cookie flags, session token entropy | 2. Authentication and 3. Session management |
| A03 Injection | SQL/NoSQL, XSS, XXE, command and template injection, path traversal | 4. Input validation and injection |
| A04 Insecure Design | Business-logic flaws: price manipulation, workflow bypass, race conditions | 7. Business logic testing |
| A05 Security Misconfiguration | Exposed files, admin interfaces, server and header misconfiguration | 1. Information gathering and reconnaissance |
| A06 Vulnerable and Outdated Components | Technology-stack, framework and version identification | 1. Information gathering and reconnaissance |
| A07 Identification and Authentication Failures | Username enumeration, lockout, MFA bypass, OAuth/SSO, token strength | 2. Authentication testing |
| A08 Software and Data Integrity Failures | File-upload content-type bypass and malicious file execution | 7. Business logic testing |
| A09 Security Logging and Monitoring Failures | Whether security events are logged and alerted on | Not a code-level test โ validate with your SOC or monitoring team |
| A10 Server-Side Request Forgery (SSRF) | SSRF in URL and file-fetching functionality | 4. Input validation and injection |
Tooling
Tools used by professionals
- Burp Suite Pro โ primary intercept proxy for all request manipulation and manual testing
- OWASP ZAP โ automated DAST scanning for OWASP Top 10, alongside manual testing
- SQLMap โ SQL injection detection and exploitation
- Nikto โ server misconfiguration, exposed files, outdated software
- Gobuster / Feroxbuster โ discovery of hidden paths, backup files, admin panels
- JWT Tool โ JSON Web Token testing for algorithm confusion and signature bypass
- Postman / Insomnia โ API endpoint testing and request manipulation
Report requirements for web application testing
- Executive summary with overall risk rating and the three most critical findings
- Methodology section referencing OWASP Testing Guide v4.2 or equivalent
- Finding-by-finding technical documentation with CVSS score, affected URL, proof-of-concept, and remediation guidance
- Evidence of testing coverage โ document all areas tested, not just findings
- Remediation priority matrix organised by severity
- Retest confirmation after remediation is complete
Working checklist
The full checklist in one place
Use this as your working checklist โ print it or copy it into your test plan. Every item below is drawn from the sections above, condensed to one line so you can tick each off during an engagement.
- Recon: enumerate every entry point โ forms, parameters, headers, cookies
- Recon: map all functionality, including hidden and unauthenticated paths
- Recon: identify the tech stack โ web server, framework, database, CDN, WAF
- Recon: review robots.txt, sitemap.xml and source comments for disclosure
- Recon: check for exposed Git repos, backup files and admin interfaces
- Recon: identify third-party integrations and their data flows
- Auth: test username enumeration via errors or response timing
- Auth: verify account lockout after failed logins
- Auth: attempt MFA bypass
- Auth: check password-strength enforcement and breach-password detection
- Auth: test OAuth/SSO for token leakage and open redirects
- Auth: verify session token entropy (minimum 128 bits)
- Auth: test login over HTTP and mixed-content flows
- Session: confirm tokens are invalidated on logout
- Session: test for session fixation
- Session: verify server-side session timeout
- Session: confirm tokens are never passed in URLs
- Session: test CSRF on every state-changing request
- Session: verify Secure, HttpOnly and SameSite cookie attributes
- Injection: SQL injection in every database-connected parameter
- Injection: NoSQL injection in document databases
- Injection: XSS โ reflected, stored and DOM-based
- Injection: XXE in XML-processing endpoints
- Injection: SSRF in URL or file-fetching functionality
- Injection: OS command injection
- Injection: server-side template injection
- Injection: path traversal in upload, download and inclusion features
- Access control: test IDOR by modifying resource identifiers
- Access control: verify no horizontal privilege escalation between users
- Access control: verify no vertical escalation to admin functions
- Access control: test forced browsing to restricted paths
- Access control: check for mass assignment in create/update endpoints
- API: document every endpoint via crawling and spec files
- API: test authentication on every endpoint, not just login
- API: test for BOLA across all resources
- API: test for broken function-level authorisation
- API: check for excessive data exposure in responses
- API: test rate limiting on auth and sensitive endpoints
- API: confirm internal endpoints are not externally reachable
- Business logic: test purchase flows for price and quantity manipulation
- Business logic: test multi-step workflows for sequence bypass
- Business logic: test file upload for content-type bypass and execution
- Business logic: test password reset for predictable tokens or race conditions
- Business logic: verify deactivated accounts cannot be reactivated by manipulation
Infronest
Conclusion
Infronest's Web Application VAPT module manages the full engagement lifecycle from scoping through report delivery. Finding documentation, CVSS scoring, Burp Suite evidence upload, peer review workflows, and client-ready PDF report generation all operate in one tenant-isolated workspace.
Start a 14-day free trial at infronest.com โ no credit card required.
Sources
Every figure and methodology reference in this article comes from the following published standards and reports. We cite them so you can verify the claims rather than take them on trust.
- OWASP Web Security Testing Guide v4.2
- OWASP Top 10 2021
- IBM โ Cost of a Data Breach Report 2025
- Verizon โ Data Breach Investigations Report 2025
- PCI Security Standards Council โ PCI DSS v4.0 Requirement 11.4
Frequently Asked Questions
- How long does web application penetration testing take?
- A standard web application penetration test for a medium-complexity application takes 5 to 10 business days. A complex application with many API endpoints, multi-role access control, and extensive business logic may take 3 to 4 weeks. Reporting adds 3 to 5 days.
- What is the difference between DAST and web application penetration testing?
- DAST (Dynamic Application Security Testing) is automated scanning that runs against a live application. Web application penetration testing includes DAST but adds manual testing for business logic flaws, chained vulnerabilities, and contextual issues that automated tools cannot identify. DAST finds the obvious; manual testing finds the dangerous.
- How often should web application penetration testing be performed?
- Annual testing is the minimum. Best practice is to trigger a test after every significant code change, new feature release, or before a major customer or compliance audit. Organisations handling payment card data (PCI DSS) must test annually at minimum, and after any significant changes.
- How much does web application penetration testing cost in India?
- In India, a focused web application penetration test typically costs โน1.5โ4 lakh (USD 2,000โ5,000). A combined network + web application VAPT for a mid-size environment runs โน5โ15 lakh (USD 6,000โ18,000), and large multi-scope programmes covering cloud, API and mobile go beyond โน25 lakh (USD 30,000+). US/EU-market engagements for comparable scope typically price two to three times higher. The final number depends on scope, asset count and whether a remediation retest is included.
- Does web application penetration testing cover the OWASP Top 10?
- A thorough engagement should map to every OWASP Top 10 2021 category, and this checklist covers nine of the ten through manual and automated testing. The exception is A09 Security Logging and Monitoring Failures, which is not a code-level test โ verify it with your SOC or monitoring team. Ask any provider to show OWASP coverage in the report, not just a list of findings.
- What tools are used for web application penetration testing?
- The core tool is an intercepting proxy such as Burp Suite (Burp Suite Professional is about โน37,700 / USD 449 per user per year) or OWASP ZAP, supported by SQLMap for injection, Nikto for misconfiguration, Gobuster or Feroxbuster for content discovery, and Postman for API testing. Tools surface candidates; the business-logic and access-control findings that matter most come from manual testing.