A phase-by-phase web application pentest methodology. The order I actually walk through an app, with the commands and gotchas at each step.
Most "web pentest checklists" online are 200-bullet OWASP transcriptions. Useful as a reference, useless as a workflow. This is the working playbook — what I do on day 1, day 2, day 3 of an engagement.
web-pentest-playbook/
├── 01-scoping.md # SoW, scope traps, lockout policies, banner agreements
├── 02-recon.md # Subdomain enum, tech detection, content discovery
├── 03-auth-session.md # Login flow, MFA, session handling, JWT, OAuth
├── 04-authorisation.md # IDOR, RBAC bypass, mass assignment
├── 05-input-validation.md # Injection points (link to payloads repo for actual payloads)
├── 06-business-logic.md # Race, replay, price manip, multi-step abuse
├── 07-client-side.md # XSS, CORS, postMessage, prototype pollution
├── 08-api.md # REST, GraphQL, SOAP, mass assignment, rate limiting
├── 09-file-upload.md # MIME bypass, polyglots, ZIP symlinks
├── 10-reporting.md # Severity rationale, evidence capture, retest
└── tools.md # The set I run, when, and why
Walk top to bottom on every engagement. Phase 01 (scoping) is non-negotiable, even if the client thinks it's done.
For payloads, see payloads repo. This playbook is the order of operations, not the payload list.
active. Drawn from Tamago Brain/30 - Resources & Tools/31 - Playbooks & Methodology/Web Application Pentest Playbook.md.
CC BY 4.0 for the writeups. MIT for any code snippets.