Skip to main content
Aesparrow Consulting

Web application VAPT checklist (OWASP Top 10 aligned)

Published · By the Aesparrow Security Research Team

Short answer

A web application VAPT checklist covers information gathering, configuration, authentication, session management, authorisation (IDOR and privilege escalation), input validation (SQL injection, XSS, command injection, SSRF, XXE), file uploads, business logic, cryptography, error handling and API security — aligned to the OWASP Top 10 and the OWASP Web Security Testing Guide.

What should a web application penetration test check?

  • Information gathering: technologies, endpoints, hidden parameters, exposed files and subdomains.
  • Configuration: security headers (CSP, HSTS), TLS, default pages, directory listing.
  • Authentication: password policy, MFA bypass, brute-force protection, password reset flaws.
  • Session management: cookie flags, token entropy, fixation, logout and timeout.
  • Access control: IDOR, horizontal and vertical privilege escalation, forced browsing.
  • Injection: SQL, NoSQL, OS command, LDAP and template injection.
  • Cross-site scripting: reflected, stored and DOM-based XSS.
  • Request forgery: CSRF and server-side request forgery (SSRF).
  • XML and deserialisation: XXE and insecure deserialisation.
  • File upload: type validation, path traversal, web-shell upload and malware.
  • Business logic: price manipulation, workflow bypass, race conditions, rate limits.
  • APIs: broken object-level authorisation, mass assignment and data exposure.

What is the OWASP Top 10?

The OWASP Top 10 is the Open Worldwide Application Security Project’s consensus list of the most critical web application security risks, such as broken access control, injection, cryptographic failures and security misconfiguration. It is the baseline most customers and auditors expect a web application penetration test to cover.

FAQ

Frequently Asked Questions

Clear answers about what we do — and what we don’t. If you have any other questions, feel free to reach out to our team.

What is OWASP Top 10 testing?

Testing a web application for each risk category in the OWASP Top 10, using techniques from the OWASP Web Security Testing Guide, to confirm the application is protected against the most common critical flaws.

How to prepare for a web application VAPT?

Provide a stable staging URL, test accounts for each role, API documentation, a list of out-of-scope functions and a technical contact, and take a backup of test data.

References & standards

Related services

Web Application VAPT & Penetration TestingAPI Penetration Testing & API Security TestingSaaS Security Assessment & SaaS Penetration Testing

Keep learning

What is the OWASP Top 10? Plain-English GuideThe OWASP Top 10 is a regularly updated list, published by the Open Worldwide Application Security Project (OWASP), of the ten most critical security risks to web applications — including broken access control, cryptographic failures, injection, insecure design and security misconfiguration.VAPT Methodology & Penetration Testing ProcessA professional VAPT methodology follows six phases: scoping and rules of engagement, reconnaissance, vulnerability discovery, exploitation, post-exploitation, and reporting with re-testing.VAPT Report Format: What a Pentest Report IncludesA good VAPT report contains an executive summary for leadership, the scope and testing window, methodology and standards used, a risk-rated list of findings with CVSS scores, evidence and reproduction steps, business impact, specific remediation guidance, and a re-test section confirming which issues have been fixed..

Browse all guides in the cybersecurity knowledge hub.

Let’s find the gaps before someone else does.

Tell us what you need tested for a fixed-scope quote, or talk it through with an Aesparrow practitioner — no obligation, no sales script.

Get a fixed-scope quote Talk to an expertExplore services
WhatsApp Call Get Quote