pentest-checklist

name	pentest-checklist
description	Complete web application pentesting methodology checklist following OWASP Testing Guide
license	MIT
compatibility	opencode
metadata	{"audience":"pentesters","workflow":"web-security"}

Pentest Checklist

Reconnaissance

• Technology fingerprinting (server, frameworks, libraries, versions)
• Crawl all accessible pages and endpoints
• Directory/file enumeration (common paths, backups, config files)
• Parameter discovery (GET, POST, Cookie, Custom Headers)
• robots.txt, sitemap.xml review
• JavaScript source analysis (API endpoints, secrets, hidden functionality)
• WAF/CDN identification and bypass research

Authentication

• Default credentials testing
• Username enumeration via timing, error messages
• Brute-force resistance (rate limiting, account lockout)
• Password policy analysis
• MFA bypass testing (response manipulation, race conditions)
• Password reset/forgot password flow testing
• JWT analysis (algorithm none, RS256→HS256 confusion, weak secrets, kid injection)
• OAuth/OIDC flow analysis (redirect_uri, state parameter, PKCE)
• Session fixation, session prediction

Authorization

• IDOR testing on all object references
• Vertical privilege escalation (user→admin)
• Horizontal privilege escalation (user→other user)
• CORS misconfiguration testing
• API endpoint authorization bypass
• Insecure Direct Object Reference in file paths

Input Validation

• XSS: reflected, stored, DOM-based, blind
• SQL injection: error-based, blind, time-based, UNION, out-of-band
• NoSQL injection (MongoDB, Redis, CouchDB)
• LDAP injection
• XPath injection
• Command injection (direct, blind, out-of-band)
• Template injection (SSTI) — Jinja2, Twig, Freemarker, Velocity, ERB, Pug
• XXE injection (in-band, out-of-band, error-based)
• HTTP parameter pollution
• HTTP request smuggling (CL.TE, TE.CL, TE.TE)

File & Resource Handling

• LFI / RFI / path traversal
• Arbitrary file upload (extension, content-type, polyglot bypass)
• Zip slip / symlink attacks
• SSRF (internal, cloud metadata, blind)
• Unrestricted file download / IDOR on downloads
• Server-side includes (SSI) injection

Business Logic

• Race conditions (TOCTOU, limit overrun, coupon reuse)
• Inconsistent validation across endpoints
• Workflow bypass / step skipping
• Negative values, integer overflow in financial logic
• Misconfigured rate limiting

API Specific

• REST API: method override (X-HTTP-Method-Override), content-type confusion
• GraphQL: introspection, batching attacks, depth/complexity DoS, field suggestions
• SOAP: WS-Security issues, XXE in SOAP
• WebSocket: origin validation, authentication in handshake
• Mass assignment in JSON/XML payloads
• BOLA (Broken Object Level Authorization) in REST

Infrastructure

• SSL/TLS configuration (weak ciphers, outdated protocols, certificate issues)
• Security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options)
• Cookie attributes (HttpOnly, Secure, SameSite, Domain/Path scope)
• Subdomain takeover
• Exposed .git, .svn, .DS_Store, backup files
• Default application pages and debug endpoints
• Cloud storage misconfigurations (S3 buckets, Azure blobs)

Post-Exploitation

• Can findings be chained for higher impact?
• Document every finding with: description, steps to reproduce, impact, CVSS
• Provide remediation advice per finding
• Executive summary with risk prioritization