Web App Pentest Roadmap — OWASP Top 10

Version: 1.0 Reference: OWASP Top 10 (2021) Scope: Full web application — from recon to reporting

Legend

Symbol	Meaning
✅	Safe to run in production
⚠️ PROD-WARNING	Risk in production — use a staging/test environment
🔴 PROD-FORBIDDEN	Never run in production without explicit written authorization
🛠️	Recommended tooling

Phase 0 — Preparation & Scope

Before a single request is sent, the legal and technical boundaries must be locked in.

[ ] Written authorization (Rules of Engagement) signed
[ ] Scope defined: domains, IP ranges, out-of-scope endpoints
[ ] Test environment identified (staging vs. production)
[ ] Client contact person available during the test
[ ] Burp Suite Pro configured (proxy, scope filter, upstream proxy if needed)
[ ] VPN/connection to the target network active if applicable
[ ] A notes structure set up (e.g. Obsidian, MkDocs draft)

Phase 1 — Reconnaissance & Mapping

1.1 Passive Reconnaissance (OSINT)

✅ Safe — no direct interaction with the target environment

[ ] WHOIS lookup of domains and IP ranges
[ ] DNS enumeration: A, MX, TXT, SPF, DMARC, CAA records
[ ] Subdomain discovery via subfinder, amass, dnsx, SecurityTrails
[ ] Certificate Transparency logs (crt.sh)
[ ] Google Dorks: site:, inurl:, filetype:, intitle:
[ ] Shodan / Censys: open ports, banners, TLS information
[ ] Wayback Machine / web archive: historical endpoints and parameters
[ ] GitHub/GitLab dorking: leaked credentials, API keys, internal code

🛠️ subfinder, amass, dnsx, gau, waybackurls, SecurityTrails, Shodan

1.2 Active Mapping

⚠️ PROD-WARNING — Increased network traffic visible in logs

[ ] Crawl the application via Burp Suite Spider / OWASP ZAP
[ ] Directory and file enumeration: ffuf, feroxbuster, gobuster
[ ] JavaScript analysis: extract endpoints, API routes, tokens
Tools: LinkFinder, JSParser, manually in DevTools
[ ] Technology fingerprinting: frameworks, CMS, libraries, versions
Tools: Wappalyzer, whatweb, Burp response headers
[ ] API schema discovery: /api/docs, /swagger.json, /openapi.yaml, GraphQL introspection
[ ] Test HTTP methods per endpoint (OPTIONS, PUT, DELETE, PATCH)
[ ] Analyze sitemap.xml and robots.txt

🛠️ Burp Suite Pro, ffuf, feroxbuster, LinkFinder, whatweb

Phase 2 — A01: Broken Access Control

OWASP #1 — The most common critical vulnerability

2.1 Horizontal Privilege Escalation (IDOR)

✅ Testable in production provided you use your own test accounts

[ ] Identify object references in URLs, POST bodies, cookies (IDs, UUIDs, slugs)
[ ] Swap your own ID for another user's
[ ] Test both sequential and UUID-based identifiers
[ ] Check whether API responses leak data not shown in the UI

2.2 Vertical Privilege Escalation

✅ Testable with your own accounts at different roles

[ ] Test admin endpoints from a low-privilege account
[ ] Force-browse to /admin, /dashboard, /config, /manage
[ ] Remove or manipulate role-based parameters in requests
[ ] Test whether UI-based restrictions are also enforced server-side

2.3 Access Control on HTTP Methods

✅ Testable in production

[ ] Try write operations (PUT, DELETE, PATCH) on read-only endpoints
[ ] Test whether HEAD requests expose filtered data

2.4 Path Traversal / Directory Traversal

⚠️ PROD-WARNING — Can read the filesystem; be careful with payloads

[ ] Test file references in parameters: ?file=, ?path=, ?include=
[ ] Payloads: ../../etc/passwd, ....//....//etc/passwd, URL-encoded variants
[ ] Test Windows paths where applicable: ..\..\windows\system32\
[ ] Check for ZIP-slip in upload functionality

🛠️ Burp Intruder, ffuf, PortSwigger path traversal labs

Phase 3 — A02: Cryptographic Failures

✅ Largely observational — safe in production

[ ] Check the TLS version and cipher suites via testssl.sh or SSL Labs
Look for: SSLv3, TLS 1.0/1.1, RC4, NULL ciphers, EXPORT ciphers
[ ] Check the HSTS header is present and configured correctly
[ ] Mixed content: HTTP resources on HTTPS pages
[ ] Sensitive data in URL parameters (passwords, tokens, session IDs)
[ ] Sensitive data in browser history, logs, referer headers
[ ] Passwords stored in plaintext (test via account reset flows)
[ ] Cookies: is the Secure flag present on sensitive cookies
[ ] Weak hashing: MD5/SHA1 for passwords (check via data breaches or error messages)
[ ] JWT analysis: alg: none, weak secrets, RS256→HS256 algorithm confusion

🛠️ testssl.sh, SSL Labs, jwt_tool, Burp Suite, hashid

Phase 4 — A03: Injection

4.1 SQL Injection

⚠️ PROD-WARNING — Destructive payloads (DROP, DELETE) are forbidden in production

[ ] Identify every input point: forms, URL params, headers, cookies, JSON body
[ ] Test for error messages with ', ", --, #
[ ] Check for blind SQLi via time-based: '; WAITFOR DELAY '0:0:5'--
[ ] Boolean-based blind: ' AND 1=1-- vs ' AND 1=2--
[ ] Out-of-band SQLi (DNS exfil via Burp Collaborator)
[ ] Test for ORM injections (HQL, JPQL, LINQ)
[ ] Automated scan with sqlmap (staging only)

🔴 PROD-FORBIDDEN — sqlmap --dump, DROP TABLE, DELETE FROM in production

🛠️ Burp Intruder, sqlmap (staging), manual payloads

4.2 Command Injection

🔴 PROD-FORBIDDEN — Never run destructive OS commands in production

[ ] Test input points that invoke OS functions (ping, nslookup, file conversion)
[ ] Payloads: ; id, | whoami, `id`, $(id)
[ ] Out-of-band detection via Burp Collaborator (DNS/HTTP pingback)
[ ] Blind command injection via time delay: ; sleep 5

⚠️ PROD-WARNING — OOB detection via Collaborator is safe; direct command execution is not

4.3 LDAP / XML / XPath Injection

⚠️ PROD-WARNING — Test with non-destructive payloads

[ ] LDAP: *)(uid=*))(|(uid=*
[ ] XML/XPath injection in SOAP/XML APIs
[ ] XXE (see also A05 below)

Phase 5 — A04: Insecure Design

✅ Largely architectural — safe to observe

[ ] Analyze business logic flows (order processes, discount codes, balances)
[ ] Test rate limiting on critical functions (login, password reset, OTP)
[ ] Check for multi-step process bypass (reaching step 2 without step 1)
[ ] Test for "negative price" or integer overflow in e-commerce
[ ] Analyze the threat model: is defense-in-depth missing?
[ ] Check whether sensitive functions are only reachable via the UI flow or also directly via the API

Phase 6 — A05: Security Misconfiguration

✅ Observational — safe in production

[ ] Test default credentials on management interfaces (admin/admin, admin/password)
[ ] Unnecessary HTTP headers: Server, X-Powered-By, X-AspNet-Version
[ ] Missing security headers:
Content-Security-Policy
X-Frame-Options or frame-ancestors
X-Content-Type-Options
Referrer-Policy
Permissions-Policy
[ ] CORS misconfiguration: wildcards, reflection of Origin, null origin
[ ] Directory listing active on the web server
[ ] Error pages: stack traces, DB versions, internal paths visible
[ ] Cloud storage: publicly accessible S3 buckets, Azure Blob containers
[ ] Debug mode active (?debug=true, FLASK_ENV=development)
[ ] Hidden admin interfaces via directory enumeration (see Phase 1.2)

XXE (XML External Entities)

⚠️ PROD-WARNING — Use OOB techniques, no file-reading payloads in production

[ ] Identify XML-processing endpoints
[ ] Test with an external entity pointing to Burp Collaborator
[ ] Test for SSRF via XXE (<!ENTITY xxe SYSTEM "http://169.254.169.254/">)

🛠️ Burp Suite, nuclei (misconfig templates)

Phase 7 — A06: Vulnerable and Outdated Components

✅ Safe to run — purely informational

[ ] Inventory all client-side libraries (JavaScript): versions via DevTools / Wappalyzer
[ ] Check npm/yarn lock files if available (e.g. via GitHub)
[ ] Server-side frameworks: version from headers, error pages or /readme, /changelog
[ ] Compare versions against CVE databases: NVD, Snyk, OSV
[ ] CMS-specific: WordPress plugin/theme versions, Drupal modules
[ ] Check for known exploits for the identified versions

🛠️ retire.js, npm audit, Snyk, wappalyzer, NVD

Phase 8 — A07: Identification and Authentication Failures

✅ Testable with your own accounts in production

[ ] Password policy: minimum complexity, maximum length
[ ] Account lockout after X failed attempts
[ ] Username enumeration via error messages or timing differences
[ ] The "forgot password" flow: token length, validity, reuse
[ ] MFA implementation: bypass via response manipulation, code reuse
[ ] "Remember me" functionality: token analysis, lifetime
[ ] OAuth2/OIDC flows: is the state parameter present, token leakage via referer

Session Management

[ ] Session token entropy and length (minimum 128 bit)
[ ] Session invalidation on logout (server-side)
[ ] Session invalidation on password change
[ ] Session fixation: does the token change after login?
[ ] Cookie attributes: HttpOnly, Secure, SameSite

🛠️ Burp Suite, ffuf (credential stuffing on staging), jwt_tool

Phase 9 — A08: Software and Data Integrity Failures

9.1 File Upload

⚠️ PROD-WARNING — Don't upload real web shells; use EICAR or harmless PoCs

[ ] Check which file types are accepted
[ ] Bypass the content-type check: change the Content-Type header
[ ] Double extension: shell.php.jpg, shell.php%00.jpg
[ ] Magic bytes manipulation
[ ] Upload to a publicly accessible location?
[ ] Filename sanitization (path traversal via filename)
[ ] SVG upload: embedded XSS or SSRF

🔴 PROD-FORBIDDEN — Do not upload functional web shells in production

9.2 CI/CD & Supply Chain

✅ Observational

[ ] Check whether CDN resources are loaded with SRI hashes
[ ] Analyze whether external packages are pinned to specific versions
[ ] Look for insecure deserialization indicators (Java serialized objects, pickle, PHP serialize)

Phase 10 — A09: Security Logging and Monitoring Failures

✅ Safe to test — observational

[ ] Deliberately generate failed login attempts — do you get an alert?
[ ] Check whether suspicious activity (SQLi strings, XSS) is logged
[ ] Look for sensitive data in logs (passwords, tokens, PII)
[ ] Check the availability of /logs, /log, /debug, /trace endpoints
[ ] Are error messages low on information for users (no stack traces)?
[ ] Is there a demonstrable incident response process?

Phase 11 — A10: Server-Side Request Forgery (SSRF)

⚠️ PROD-WARNING — Use Burp Collaborator for OOB detection; don't run internal scans in production

[ ] Identify parameters that process URLs or hostnames (url=, webhook=, redirect=, load=, fetch=)
[ ] Test for internal network access: http://127.0.0.1, http://localhost
[ ] Cloud metadata endpoint: http://169.254.169.254/latest/meta-data/
[ ] SSRF via indirect inputs: PDF generators, image processors, import functions
[ ] Blind SSRF detection via Burp Collaborator (DNS/HTTP callback)
[ ] Protocol switching: file://, dict://, gopher://
[ ] SSRF filter bypass: http://127.0.0.1#@evil.com, decimal IP notation, IPv6 [::1]

🔴 PROD-FORBIDDEN — Do not run an internal port scan via SSRF in production

🛠️ Burp Collaborator, ssrfmap, manual payloads

Phase 12 — Cross-Site Scripting (XSS)

Not a separate category in the OWASP Top 10 2021, but falls under A03 Injection

12.1 Reflected XSS

✅ Testable in production provided there's no persistence

[ ] Identify input points that reflect input back in the response
[ ] Test in URL parameters, search fields, error messages
[ ] Check the HTML context, attribute context, JavaScript context, URL context

12.2 Stored XSS

⚠️ PROD-WARNING — Use unique, recognizable payloads; remove them immediately after confirmation

[ ] Identify storage points: comments, profile fields, message forms
[ ] Test for a stored payload that renders for other users
[ ] Check admin panels: stored XSS that hits admins is critical

12.3 DOM-Based XSS

✅ Testable in production — client-side only

[ ] Analyze JavaScript: document.location, innerHTML, eval(), document.write()
[ ] Test #fragment-based injection
[ ] Use browser DevTools and DOM Invader (Burp Suite)

🛠️ Burp Suite DOM Invader, dalfox, manual analysis

Phase 13 — CSRF

✅ Testable in production with your own account

[ ] Check for the presence of a CSRF token on state-changing requests
[ ] Check whether the CSRF token is validated server-side (remove/empty the token)
[ ] Test the SameSite cookie attribute as a CSRF mitigation
[ ] Test for JSON CSRF (Content-Type: text/plain attacks)
[ ] Check for predictable or static CSRF tokens

Phase 14 — API-Specific Tests

⚠️ PROD-WARNING — Rate limiting and mass assignment can mutate data

[ ] REST API: test all CRUD operations per endpoint
[ ] GraphQL: introspection query, batch queries, mutation testing
[ ] Mass assignment: send extra fields in POST/PUT (role, isAdmin, balance)
[ ] API versioning: test outdated versions (/v1/ alongside /v2/)
[ ] Check whether internal API endpoints are reachable without authentication
[ ] JWT validation: alg: none, algorithm confusion (RS256→HS256), expired tokens
[ ] API rate limiting and quota bypass

🛠️ Burp Suite, Postman, graphql-cop, jwt_tool

Phase 15 — Business Logic Testing

✅ Testable with your own accounts

[ ] Force negative values (quantities, prices, discounts)
[ ] Test workflow bypass: go straight to step 3 without steps 1 and 2
[ ] Test for race conditions on critical actions (payment, activation, limit checks)
[ ] Coupon/discount code: use multiple times, stack, negative discounts
[ ] Test role switching mid-session

Race Conditions

🔴 PROD-FORBIDDEN — Race condition attacks on financial transactions in production

[ ] Use Burp Suite "Send group in parallel" for simultaneous requests
[ ] Test for TOCTOU (Time-of-Check to Time-of-Use) vulnerabilities

Phase 16 — Infrastructure & Network (if in scope)

⚠️ PROD-WARNING — Port scanning is visible in logs and can trigger IDS/IPS

[ ] Port scan: nmap -sV -sC --top-ports 1000
[ ] Service fingerprinting: versions, banners
[ ] Check SSL/TLS on all services
[ ] Open ports that aren't in scope: document and report
[ ] Firewall rule testing: reachability of internal services

🔴 PROD-FORBIDDEN — Aggressive scans (-T5, --script vuln) without explicit authorization

🛠️ nmap, masscan (staging only)

Phase 17 — Reporting

[ ] Findings ordered by risk (Critical → High → Medium → Low → Informational)
[ ] Per finding: description, reproduction steps, impact, CVSS score, recommendation
[ ] Evidence: screenshots, Burp requests/responses, video where relevant
[ ] Executive summary for management
[ ] Technical report for the development team
[ ] Remediation advice that is concrete and actionable
[ ] A retest scheduled after fixes

Production-Warning Summary

Test	Production status
Passive OSINT	✅ Always safe
Directory enumeration	⚠️ Increased traffic
SQL Injection detection (error messages)	⚠️ Be careful
SQLi with `DROP`/`DELETE`	🔴 Forbidden
Command injection detection (OOB)	⚠️ Only via Collaborator
Command injection execution	🔴 Forbidden
XSS reflected	✅ Safe
XSS stored	⚠️ Remove immediately after testing
SSRF detection (Collaborator)	⚠️ Safe via OOB
SSRF internal scan	🔴 Forbidden
Web shell upload	🔴 Forbidden
Race conditions (financial)	🔴 Forbidden
Aggressive port scans	🔴 Forbidden without authorization
Path traversal payloads	⚠️ Read only, not write