Web Pentest Checklist

Otomatik

• Otomatize Taramalar (Burp Active Scan)

• Otomatize Taramalar (Acunetix)

• Otomatize Taramalar (Nessus)

• Otomatize Taramalar (Qualys)

Server

• Header Version Disclosure

• Dirsearch

• Burp Find Comments

• Directory Listing

• Insecure Headers (TRACE, DEBUG)

• IIS Tilde (IIS Server ise)

• WP-Scan (Wordpress ise)

• SSL/TLS

• Security Headers

Input Testleri

• XSS

• SQL Injection veya NoSQL Injection

• SSTI

• CSTI

• Paramater Pollution

• XXE Injection

• SSRF

• LFI ve RFI

• Directory Traversal

• OS Command Injection

• Insecure Deserialization

• File Upload

• CSRF

• Detaylı Hata Mesajları

• Type Juggling

• CRLF Injection (%0D%0A)

• XPath Injection

• HTTP Request Smuggling

• Race Condition

• LDAP Injection

• UUID Version 1 Kullanımı

• CORS

• Business Logic

• Captcha Bypass

• Open Redirect

• Web Cache Poisoning

• Integer Overflow (2147483647)

Authantication

• Rate Limit (Login, MFA, Password Reset vb kritik işlemler)

• Rate Limit Bypass Headers (X-Forwarded-For gibi)

• Response Code Manipulation

• Username Enumeration

• Response Time (Cok uzun parola ile username bruteforce)

• OAUTH Zafiyetleri

• Password Reset Host Header Poisoning

• Password Reset Tahmin Edilebilir Token

• Password Reset Expire Oluyor Mu

Authorization

• IDOR

• Anonim Erişilebilen Kritik Endpointler

• Broken Access Control

• 403 Bypass

Session

• JWT Zafiyetleri

• Session Çerezlerinde HTTP Only ve Secure Flaglari

• Session bilgisi URL de gözükmesi