Skip to main content
Now booking new VAPT & API security engagements • Free external security scan — no signup Run it
Free Scan Request a Quote

Web Application VAPT Checklist

A practical, professional checklist you can use to self-assess or to brief a tester. Tick items as you go, or print it for your team.

Use this checklist for authorised testing only. Several checks can affect production stability — always test with permission.

Authentication

  • Test default, weak and reused credentials; enforce a strong password policy.
  • Verify account lockout / throttling and brute-force resistance.
  • Check for username enumeration on login, registration and reset flows.
  • Test MFA enrolment, bypass and recovery paths.
  • Review password reset tokens: entropy, expiry, single-use, no leakage in URLs.
  • Confirm credentials are transmitted only over HTTPS.

Session Management

  • Inspect cookie flags: Secure, HttpOnly, SameSite.
  • Test session fixation and regeneration after login.
  • Verify logout invalidates the session server-side.
  • Check idle and absolute session timeouts.
  • Ensure session identifiers are long, random and never in URLs.

Authorization

  • Test horizontal access control (IDOR/BOLA) with two accounts.
  • Test vertical access control / privilege escalation across roles.
  • Verify server-side authorization on every endpoint (not just hidden UI).
  • Check function-level authorization for admin and API-only functions.
  • Review mass assignment / property-level authorization.

Injection

  • Test SQL injection (error, boolean, time-based, out-of-band).
  • Test NoSQL, LDAP, template and command injection where applicable.
  • Test OS command injection in uploads, imports and report generators.
  • Verify parameterized queries and least-privilege database accounts.

Cross-Site Scripting & CSRF

  • Test reflected, stored and DOM-based XSS in every input/output context.
  • Verify context-aware output encoding.
  • Test CSRF protection on all state-changing requests.
  • Check SameSite cookies and origin/header validation.

Server-Side Request Forgery

  • Identify features that fetch URLs, images or webhooks.
  • Test blocking of internal, loopback, link-local and metadata addresses.
  • Verify redirect handling and DNS-rebinding protections.
  • Check response bodies are not returned to the user unfiltered.

File & Data Handling

  • Test file upload type, extension and content validation.
  • Test path traversal and local/remote file inclusion.
  • Check sensitive-data exposure in responses, logs and backups.
  • Verify cryptographic storage of secrets and personal data.

API Security (OWASP API Top 10)

  • Map every endpoint, including shadow and deprecated versions.
  • Test BOLA/IDOR across all object identifiers.
  • Test broken authentication (JWT/OAuth) and token handling.
  • Verify rate limiting and resource-consumption controls.
  • Check excessive data exposure and mass assignment.

Configuration & Transport

  • Review security headers (CSP, HSTS, X-Content-Type-Options, etc.).
  • Scan for exposed sensitive files, backups and admin panels.
  • Check TLS configuration, ciphers and certificate validity.
  • Confirm verbose errors and stack traces are disabled in production.
  • Identify outdated components with known CVEs.

Business Logic

  • Walk every workflow and abuse it (skip steps, reorder, replay).
  • Test price, quantity, discount and entitlement manipulation.
  • Test race conditions and concurrent-request abuse.
  • Verify idempotency and server-side validation of trusted operations.

Want a professional to run this properly?

A checklist is a starting point. A validated VAPT finds what checklists miss and proves impact.

Request a VAPT