OWASP Web Security Testing Guide

1. Information Gathering

   Reconnaissance, fingerprinting and application entry point mapping.

2. Configuration and Deployment Management Testing

   Infrastructure, HTTP methods, HSTS, backups and admin interface testing.

3. Identity Management Testing

   Role definitions, registration and account enumeration testing.

4. Authentication Testing

   Credential transport, default credentials, lockout, bypass and weak password testing.

5. Authorization Testing

   Path traversal, privilege escalation and IDOR testing.

6. Session Management Testing

   Cookies, fixation, CSRF, logout and session timeout testing.

7. Input Validation Testing

   XSS, SQL injection, command injection, SSRF and template injection testing.

8. Error Handling Testing

   Improper error handling and stack trace exposure.

9. Weak Cryptography Testing

   Weak TLS, padding oracle and unencrypted channel testing.

10. Business Logic Testing

    Workflow, file upload and business rule abuse testing.

11. Client-side Testing

    DOM XSS, clickjacking, CORS, WebSockets and browser storage testing.

12. API Testing

    GraphQL and API-specific security testing.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.