CyberLabs
Penetration Testing Hub · cyberlabs.ie
Web Application Security Checklist
Nine checks against the OWASP flaws that dominate real web testing. Test access control yourself as a low-privilege user before you hire anyone.
Before you test — Only test web applications you own or have explicit written permission to test. Unauthorised access is a criminal offence in Ireland under the Criminal Justice (Offences Relating to Information Systems) Act 2017.
Access control & authentication
Every sensitive action re-checks the user's permissions server-side, not just by hiding a button. Changing an ID in a URL or request doesn't expose another user's data (test as a low-privilege user). Sessions expire, log out properly, and rotate on privilege change. Input & injection
User input is parameterised at the database layer — no string-built SQL. File uploads are validated by content, not just extension, and stored outside the web root. Rate limiting protects login and any expensive or abusable endpoint. Configuration & hygiene
Error messages don't leak stack traces, versions or queries to the user. Security headers are set (CSP, HSTS, X-Content-Type-Options). Dependencies are current — no known-vulnerable libraries (check with a scanner).