Web_Pentest_Checklist.md

🌐 Web Application Pentesting Checklist

A systematic approach to testing web applications.

Phase 1: Reconnaissance

• Subdomain Enumeration (subfinder, amass, assetfinder)
• Directory Brute-forcing (gobuster, ffuf, dirsearch)
• Technology Stack Identification (whatweb, Wappalyzer extension)
• Parameter Discovery (arjun, finding hidden inputs)

Phase 2: Authentication & Authorization testing

• Test for Default Credentials.
• Test Username Enumeration (login, password reset).
• Test Password Policy (weak passwords accepted?).
• Test for IDOR (Insecure Direct Object Reference) on sensitive endpoints (e.g., user_id=123).
• Test Session Management (JWT weaknesses, session fixation).

Phase 3: Injection Flaws

• SQL Injection (SQLi): Test input fields and URL parameters with ', ", OR 1=1.
• Cross-Site Scripting (XSS): Test inputs with <script>alert(1)</script> or "><svg/onload=alert(1)>.
  • Stored XSS
  • Reflected XSS
  • DOM-based XSS
• Command Injection: Test parameters intended for system execution with ; id, | whoami, & dir.

Phase 4: Business Logic & Misc

• Server-Side Request Forgery (SSRF): Test image uploads and webhook parameters.
• File Inclusion (LFI/RFI): Test paths like ?page=../../../../etc/passwd.
• CORS Misconfigurations: Test if arbitrary origins are trusted.
• Check for sensitive data exposure in source code or robots.txt.