OWASP Web Security Testing Guide
Test coverage for web application security assessment.
Penetration testing
Web Application Penetration Testing
A review led by a tester of a web application's security controls, including authenticated workflows and business logic that automated scanners cannot assess reliably.
Assessment scope
What is tested
The final test coverage is agreed during scoping and limited to systems for which written authorization has been provided.
Authentication and account recovery
Session management
Access control and privilege boundaries
Input handling and injection risks
Abuse of business logic
Sensitive data and browser security controls
Engagement flow
Controlled from authorization to retest.
01
Scope & authorization
Define objectives, approved systems, constraints, test windows, contacts, and rules of engagement.
02
Discovery
Establish the authorized attack surface, architecture, user roles, assets, and applicable assessment criteria.
03
Controlled testing
Assess the approved scope using manual and technical methods appropriate to the environment.
04
Validation
Confirm findings safely, remove false positives, and establish practical technical and business impact.
05
Reporting
Receive findings supported by evidence, risk ratings, an executive summary, and remediation priorities.
06
Remediation review
Review proposed corrective actions and clarify implementation priorities with the assessment team.
07
Retest
Verify agreed fixes and record whether each tested finding has been resolved, reduced, or remains open.
Assessment references
Industry standards and guidance
OWASP ASVS
Verification of controls and reporting context where an assurance level is agreed.
PTES
Scoping, controlled validation, analysis after testing, and reporting.
Standards guide scope and test coverage. An assessment does not itself constitute certification or guarantee compliance.
Reporting
What you receive
Coverage mapped to agreed application functions
Reproducible technical findings
Evidence and affected roles
Remediation guidance for development teams
Optional verification retest
Define an appropriate test scope.
Discuss the systems, objectives, access level, and required evidence with DIGITPOL.