Penetration Testing Hub · cyberlabs.ie

Web Application Security Checklist

Nine checks against the OWASP flaws that dominate real web testing. Test access control yourself as a low-privilege user before you hire anyone.

Before you test — Only test web applications you own or have explicit written permission to test. Unauthorised access is a criminal offence in Ireland under the Criminal Justice (Offences Relating to Information Systems) Act 2017.

Access control & authentication

Every sensitive action re-checks the user's permissions server-side, not just by hiding a button.
Changing an ID in a URL or request doesn't expose another user's data (test as a low-privilege user).
Sessions expire, log out properly, and rotate on privilege change.

Input & injection

User input is parameterised at the database layer — no string-built SQL.
File uploads are validated by content, not just extension, and stored outside the web root.
Rate limiting protects login and any expensive or abusable endpoint.

Configuration & hygiene

Error messages don't leak stack traces, versions or queries to the user.
Security headers are set (CSP, HSTS, X-Content-Type-Options).
Dependencies are current — no known-vulnerable libraries (check with a scanner).
Educational, not legal advice. Test only what you own or are authorised to test.
Full guide: Web Application Penetration Testing Methodology
© CyberLabs · cyberlabs.ie