performing-web-application-penetration-test

# Performing Web Application Penetration Test ## When to Use - Testing web applications before production deployment to identify exploitable vulnerabilities - Conducting compliance-driven security assessments (PCI-DSS requirement 6.6, SOC 2 Type II) - Validating remediation of previously identified web application vulnerabilities during retesting - Assessing third-party web applications before integration into the organization's environment - Evaluating custom-developed web applications where automated scanning alone is insufficient **Do not use** against web applications without written authorization, against production systems during peak traffic hours without explicit approval, or for denial-of-service testing of web infrastructure. ## Prerequisites - Signed statement of work (SoW) defining the target application URLs, environments (staging/production), and testing boundaries - Burp Suite Professional license with up-to-date extensions (Active Scan++, Autorize, JSON Beautifier, Logger++) - Valid test accounts at each privilege level (unauthenticated, standard user, administrator) for authorization testing - Application documentation including API specifications (OpenAPI/Swagger), sitemap, and technology stack details - Browser configured with Burp Suite proxy (FoxyProxy recommended) and Burp CA certificate installed ## Workflow ### Step 1: Reconnaissance and Application Mapping Map the entire attack surface of the web application: - Configure Burp Suite proxy and ...