Web Application Penetration Testing Checklist: The 2026 Developer & Security Guide

Modern web applications are vastly more complex than the static sites and simple CRUD endpoints of a decade ago. Between Single Page Applications (SPAs), microservices, GraphQL gateways, WebSocket feeds, and third-party SaaS integrations, traditional automated vulnerability scanners catch less than 20% of critical vulnerabilities.

Whether you are preparing for an external penetration test, conducting an internal security review, or hardening your production environment, here is the technical penetration testing checklist we use at Mighty Infosec to evaluate web application security.

---

1. Reconnaissance & Surface Mapping

Before touching exploitation tools, a comprehensive map of the perimeter is required:

• Subdomain Enumeration: Discover inactive staging, dev, and legacy subdomains (staging.api, admin-v1, internal-portal).
• DNS Record Audit: Verify SPF, DKIM, and DMARC enforcement. Check for dangling CNAME records susceptible to subdomain takeover.
• Technology Fingerprinting: Identify backend frameworks, Web Application Firewalls (Cloudflare, AWS WAF), CDN routing, and server versions.
• Exposed Metadata & Git Repositories: Verify that .git/, .env, Swagger/OpenAPI UI, GraphQL schema introspection, or server health endpoints (/actuator, /metrics) are not reachable without authentication.

---

2. Authentication & Session Security

Authentication flaws remain the fastest route for attackers to achieve complete account takeover.

• Brute Force & Credential Stuffing Defenses: Verify progressive rate limiting, IP reputation filtering, and CAPTCHA / Turnstile mechanisms on /login, /register, and /forgot-password.
• Multi-Factor Authentication (MFA) Bypass:
  • Can MFA prompt be bypassed by directly requesting post-login endpoints?
  • Can the MFA challenge state be manipulated or replayed?
  • Does the "Remember this device" token contain cryptographically secure entropy?
• OAuth & SAML Single Sign-On (SSO):
  • Verify state parameter validation to prevent OAuth CSRF login hijacking.
  • Check for permissive redirect_uri parsing (e.g., wildcard domains or path traversal).
  • Check token signature validation and audience (aud) verification.
• JWT (JSON Web Token) Security:
  • Test for weak signing secrets (HMAC dictionary attack).
  • Verify token expiration enforcement and token revocation upon user logout or password change.
  • Check for algorithm switching attacks (none or RS256 to HS256 key confusion).
• Session Cookie Attributes: Ensure session cookies enforce Secure, HttpOnly, and SameSite=Lax or Strict.

---

3. Authorization & Multi-Tenancy (BOLA / IDOR)

In modern SaaS, Broken Object Level Authorization (BOLA / IDOR) is the number one cause of cross-tenant data leaks. Automated scanners routinely miss these flaws because they require understanding business semantics.

• Horizontal Privilege Escalation: Attempt accessing Tenant A's documents, invoices, or API keys using Tenant B's credentials by replacing IDs in path parameters, query strings, or JSON bodies.
• Vertical Privilege Escalation: Attempt executing administrative actions (e.g., inviting users, toggling feature flags, changing tenant billing tiers) from standard member or viewer accounts.
• State Machine & Step Skipping: On multi-step workflows (e.g., onboarding, checkout, KYC verification), verify whether final steps can be called directly without completing prerequisites.
• Soft-Deleted & Archived Object Access: Test whether deactivated or deleted resources can still be retrieved or modified by unauthorized users.

---

4. Input Validation & Injection Attacks

• Server-Side Request Forgery (SSRF): Test any feature that fetches remote content (URL previews, webhooks, PDF generators, avatar imports) against:
  • Internal metadata services (http://169.254.169.254/ on AWS/GCP).
  • Localhost endpoints (http://127.0.0.1:8080, http://[::1]).
  • DNS rebinding vectors and IPv6 encodings.
• SQL & NoSQL Injection:
  • Test both error-based, time-based blind, and Boolean blind payloads across all parameters, HTTP headers (X-Forwarded-For), and sorting parameters.
  • For MongoDB/PostgreSQL JSON queries, test for JSON query operator injection ({"$gt": ""}).
• Cross-Site Scripting (XSS):
  • Stored XSS in user profiles, team names, comments, and file metadata.
  • DOM-based XSS via window.location hashes and vulnerable client-side dependencies.
  • Content Security Policy (CSP) robustness: verify script-src does not permit unsafe-inline or bypassable CDNs.
• Server-Side Template Injection (SSTI): Test template rendering engines (Jinja, Handlebars, Twig) for expression evaluation ({{7*7}}).

---

5. Business Logic & Payment Flows

Business logic flaws do not trigger scanner alerts because the application behaves according to code, but against business intention.

• Negative / Zero Quantity Manipulation: Can item quantities, discounts, or prices be set to negative values in cart checkout or subscription upgrades?
• Currency & Rounding Exploits: Rounding manipulation on fractional token or unit purchases.
• Concurrency & Race Conditions:
  • Can a coupon code or promotional gift balance be applied multiple times in parallel threads?
  • Can a single credit balance be withdrawn or transferred simultaneously across concurrent requests?
• Rate Limit & Tier Bypass: Can restricted tier features be unlocked by manipulating request payloads or headers?

---

6. Secure Retesting & Remediation

A penetration test is only as good as the verified fixes that follow:

1. Verify Root Cause, Not Just the Payload: Don't just block the specific exploit string with a regex; apply parameterized queries, strict authorization middleware, and type validation.
2. Regression Retesting: Every high and critical issue must be re-attacked to verify that patches cannot be bypassed with alternative encodings or sibling endpoints.
3. Letter of Attestation: Share your clean, retested report and executive attestation with enterprise prospects, security questionnaires, and compliance auditors (SOC 2, ISO 27001).

---

Expert Human Testing with Mighty Infosec

Automated scanners cover basic syntax; elite researchers uncover the architectural and business logic flaws that actually lead to breaches.

At Mighty Infosec, our testing combines agentic coverage with human researchers who have earned HackerOne Top 1% rankings and Hall of Fame credits at X, Netflix, and Tencent.

• Zero Scanner Fluff: Developer-friendly proof-of-concept steps and code-level remediation.
• Included Re-Testing: We verify your patches and provide an official Letter of Attestation.
• Speed & Coverage: Full scoping within 24 hours.

Book a free 30-minute scoping call or generate a free preliminary threat model in your browser with our Threat Model Studio.