Web Application Penetration Test
Comprehensive Web Application Penetration Testing Checklist with Tools and Key Items
Last updated
Comprehensive Web Application Penetration Testing Checklist with Tools and Key Items
Last updated
Pre-Engagement Phase
Define Scope:
Identify target application(s) and environment.
Establish testing boundaries and limitations.
Obtain necessary permissions and legal clearances.
Information Gathering:
Passive Reconnaissance:
Collect information without interacting with the target directly.
Tools: Google Dorking, Shodan, Censys.
Key Items: Domain information, IP addresses, DNS records, publicly exposed sensitive information.
Sources: (), ().
Active Reconnaissance:
Conduct WHOIS lookup.
Identify subdomains and enumerate directories.
Tools: WHOIS, Sublist3r, Dirb/Dirbuster, Nmap.
Key Items: Subdomains, open ports, services, directory structure.
Sources: (), ().
Testing Phase
Configuration and Deployment Management Testing:
Verify secure configuration of servers, frameworks, and application components.
Tools: Nikto, Nessus.
Key Items: Default accounts, unnecessary services, outdated software, sensitive information in configuration files.
Authentication Testing:
Test for weak passwords and default credentials.
Evaluate multi-factor authentication (MFA) implementation.
Tools: Hydra, Burp Suite Intruder, Medusa.
Key Items: Password policies, MFA implementation, brute force protection, session fixation vulnerabilities.
Session Management Testing:
Examine session tokens for predictability and entropy.
Tools: Burp Suite, OWASP ZAP.
Key Items: Session token security, session hijacking, session fixation, secure storage and transmission of session cookies, session timeout and logout functionality.
Access Control Testing:
Test for broken access controls and authorization issues.
Tools: Burp Suite, Postman, OWASP ZAP.
Key Items: Vertical and horizontal privilege escalation, server-side access control enforcement, IDOR vulnerabilities.
Input Validation Testing:
Test for SQL Injection vulnerabilities using automated tools and manual techniques.
Tools: SQLmap, Burp Suite, OWASP ZAP.
Key Items: SQL Injection, Cross-Site Scripting (XSS), Command Injection, File Inclusion, input validation mechanisms.
Testing for Business Logic Vulnerabilities:
Identify and exploit flaws in the application’s business logic.
Tools: Manual testing, custom scripts.
Key Items: Manipulation of business workflows, integrity of multi-step processes and transactions.
Client-Side Testing:
Test for Cross-Site Request Forgery (CSRF) vulnerabilities.
Evaluate the security of JavaScript and client-side code.
Tools: Burp Suite, OWASP ZAP, Browser Developer Tools.
Key Items: CSRF, JavaScript security, HTML5 and browser storage, Clickjacking and UI redressing attacks.
API Testing:
Identify and map out all API endpoints.
Tools: Postman, Burp Suite, OWASP ZAP.
Key Items: API authentication, input validation and output encoding, excessive data exposure, rate limiting.
Cryptography Testing:
Verify the use of strong encryption algorithms and protocols.
Tools: SSL Labs, OpenSSL, TestSSL.sh.
Key Items: Encryption algorithms and protocols, SSL/TLS implementation, cryptographic storage, cryptographic keys and certificates.
Denial of Service (DoS) Testing:
Identify and test for potential DoS attack vectors.
Tools: LOIC, HOIC, Slowloris.
Key Items: Rate limiting and throttling, application’s ability to handle high loads.
Testing for Error Handling:
Check for information leakage through error messages.
Tools: Burp Suite, OWASP ZAP.
Key Items: Error message handling, response to unexpected inputs, exposure of stack traces and debug information.
Reporting Phase
Document Findings:
Create detailed reports of vulnerabilities discovered.
Tools: Dradis, Faraday.
Key Items: Steps to reproduce, potential impact, remediation recommendations.
Provide Executive Summary:
Summarize key findings for non-technical stakeholders.
Tools: Custom templates.
Key Items: Overall security posture, strategic improvements, next steps.
Post-Engagement Phase
Remediation Support:
Offer guidance and support for fixing identified vulnerabilities.
Tools: Jira, Confluence.
Key Items: Verification of applied fixes, best practices for maintaining security.
Review and Reflect:
Conduct a post-engagement review with the team.
Tools: Team meetings, retrospective tools.
Key Items: Lessons learned, potential improvements, updates to methodologies and tools.
References
OWASP Top 10
Sources: (), ().
Sources: (), ().
Sources: (), ().
Sources: (), ().
Sources: (), ().
Sources: (), ().
Sources: (), ().
Sources: (), ().
Sources: (), ().
Sources: (), ().
Sources: (), ().
Sources: (), ().
Sources: (), ().
Sources: (), ().
Sources: (), ().