A penetration test is a controlled, authorised attack on your own application, carried out to find out what a real attacker could do. This checklist follows a web application penetration test from start to finish: 14 phases and 91 checks, from the rules of engagement to the retest.

Only test systems you own or have written permission to test.

Each check shows how it is usually carried out:

• Automated: Vooki Pro does this step for you.
• Automated + manual review: Vooki Pro finds the issue and gives the evidence; a tester confirms it and shows the impact.
• Manual: a person has to do this.

58 of the 91 checks can be automated in full or in part. The rest, including the rules of engagement, chaining findings and business logic, need a skilled tester.

1. Pre-engagement and rules of engagement

Nothing is tested until these are agreed in writing.

2. Reconnaissance

Learn what an outside attacker could learn, without touching the target more than needed.

3. Map the application

4. Automated vulnerability scanning

Cover the breadth quickly, so manual time goes on depth.

5. Attack authentication and sessions

6. Attack authorization

Use the role matrix from step 3 and swap between accounts.

7. Attack the server side

The scanner finds and evidences these; the tester shows what they allow.

8. Attack the client side

9. Attack the business logic

This is where a human tester adds the most.

10. Attack the APIs

11. Chain findings and show impact

12. Clean up

13. Report

14. Fix, retest and keep testing

Penetration test or vulnerability assessment?

A vulnerability assessment is about breadth: find and rate every weakness you can. A penetration test is about depth: exploit the weaknesses that matter and show what they lead to. If you need the breadth-first version, use the web application vulnerability assessment checklist.

How Vooki Pro helps

• Covers the broad, repeatable part of a penetration test (mapping, scanning, version and CVE checks) in a single authenticated scan, so testers can spend their time on exploitation and business logic.
• Finds and evidences the issues in sections 5 to 10: each finding shows the request, the response and the injected payload, which gives a tester a head start on proving impact.
• Tells you when a scan was logged out or blocked by a WAF, so gaps in coverage are visible.
• Exports standard and compliance reports, and a .vpscan archive that carries the whole scan to another tester's machine.
• Retests fixes and runs scheduled scans between penetration tests, so new releases are not left untested for months.

Frequently asked questions

What is the difference between a vulnerability assessment and a penetration test?

A vulnerability assessment finds and rates as many weaknesses as possible. A penetration test goes further: it exploits weaknesses, chains them together and shows the real impact on the business.

How often should a web application be penetration tested?

Usually once or twice a year, and after major changes. Many compliance frameworks, including PCI DSS, expect regular testing. Automated scanning should run between tests.

Can a scanner replace a penetration test?

No. A scanner covers known vulnerability classes quickly and consistently. A penetration tester finds business-logic flaws and chains issues in ways a tool cannot. They work best together.

Is penetration testing legal?

Only with written permission from the system owner. Testing systems you do not own or are not authorised to test is illegal in most countries.

Related: Web application vulnerability assessment checklist · DAST vs SAST vs penetration testing: which do you need? · Penetration testing tools: what they are and why they matter