Web application testing checklist

Work top to bottom; each item links to the skill that goes deep. Confirm scope first (tradecraft-scope-roe).

Recon & mapping

• Subdomains + live hosts (recon-subdomain-enum), DNS (recon-dns-analysis)
• Content/endpoint + param discovery (recon-content-discovery), JS mining (recon-js-analysis)
• Fingerprint stack/versions; note WAF/CDN (web-arsenal)

Authentication & session

• Login/registration flaws, username enumeration, rate limiting
• Password reset & email change (web-account-takeover), OTP/2FA bypass
• Session handling & JWT (web-auth-jwt); OAuth/SSO (web-oauth)

Authorization

• IDOR / object-level (web-idor); function-level / forced browsing
• Multi-tenant boundary crossing

Input handling (injection & rendering)

• XSS reflected/stored/DOM (web-xss, payloads-xss-polyglots)
• SQLi (web-sqli), NoSQLi; SSTI (web-ssti); command injection
• SSRF (web-ssrf); XXE (web-xxe); LFI/traversal (web-lfi-path-traversal)
• Deserialization (web-deserialization); prototype pollution (web-prototype-pollution)

App logic & client

• Business logic (web-business-logic); race conditions (web-race-conditions)
• File upload (web-file-upload); CSRF (web-csrf); CORS (web-cors); open redirect (web-open-redirect)
• Host-header/cache (web-cache-poisoning), request smuggling (web-request-smuggling)

Before reporting

• Impact proven & reproducible; evidence captured; severity set (reporting-bug-bounty-writeup)
• In scope, within RoE; no real data hoarded

Notes

A checklist is a coverage aid, not a substitute for judgment — follow the leads that look weird.