Whether you are preparing for a web application penetration test or running internal pre-release checks, a structured checklist keeps you from missing the categories that cause real breaches. This OWASP-based checklist walks the attack surface the way a tester does — from access control to business logic.
Before testing: preparation checklist
- Define scope: domains, subdomains, APIs and which environments are in play.
- Provision test accounts — ideally two per role, so access-control bugs can be proven.
- Agree a test window and rules of engagement; identify anything fragile.
- Ensure logging and monitoring are on, so you can compare detection against the tester’s activity.
- Snapshot or back up staging so tests are safe to run aggressively.
1. Access control & authorisation
The single most impactful category. Test every object reference and every privileged action across roles:
- Can user A read, edit or delete user B’s records by changing an ID? (IDOR)
- Can a low-privilege user reach admin-only functions directly? (function-level access)
- Do server-side checks exist, or does the UI merely hide buttons?
This is where broken access control & IDOR testing focuses, and it remains the OWASP #1 risk.
2. Authentication & session management
- Password policy, brute-force protection and account lockout.
- Session token strength, rotation on login, and invalidation on logout.
- Password-reset and email-change flows (a classic account-takeover path).
- Multi-factor coverage and bypass attempts.
3. Input handling & injection
- SQL, NoSQL and command injection on every input that reaches a backend.
- Cross-site scripting — reflected, stored and DOM-based.
- Server-side template injection and deserialisation.
- File-upload validation and path traversal.
These map directly to the OWASP Top 10 and to the vulnerabilities we cover in the web vulnerabilities we exploit most.
4. Business logic
Scanners cannot find these — humans must. Check whether workflows can be abused: negative quantities, skipped payment steps, coupon stacking, race conditions on limited resources, and multi-step processes completed out of order. For shops this is critical — see e-commerce penetration testing.
5. APIs & configuration
- Broken object- and function-level authorisation on every endpoint (API penetration testing).
- Excessive data exposure and mass assignment.
- Security headers, TLS configuration and cookie flags.
- Verbose errors, exposed debug endpoints and leaked secrets.
6. Reporting & retest
A finding is only useful if it is reproducible and prioritised. Insist on CVSS ratings, business-impact context, copy-paste reproductions and a retest after fixes. Anything less leaves you guessing.
Frequently asked questions
Can I run this checklist myself? The preparation and configuration items, yes. Access-control and business-logic testing genuinely require an experienced tester to do well.
How often should we test? At least annually, and after any significant change to authentication, authorisation or architecture.
Want this checklist executed end to end by senior testers? See our web application penetration testing service or request a fixed-price quote.