Web Pentest Checklist

Expand a phase, read each group's “when to test” note to see whether it applies to the feature in front of you, then tick checks as you clear them. Progress is saved in your browser. Tool and vuln chips link into the Toolkit and Vulns & Misconfigs.

The first phases are a practical, bug-hunting flow. The WSTG-tagged sections below mirror the full OWASP Web Security Testing Guide so you can also work the engagement as a complete, ID-by-ID coverage checklist.