Basic Web Application Testing Checklist for Beginners

December 25, 2018 | Views: 1929

Begin Learning Cyber Security for FREE Now!

FREE REGISTRATIONAlready a Member Login Here


In this article, you can see the listed basic checklist to start with the Web Application Testing. There is lot more vulnerabilities are there and those will be updated in the future post. Here are the basic Web Application Vulnerability checklist for absolute beginners.

  • Click-jacking
  • Plain-text communication
  • Password Hashing
  • Email Address Disclosure
  • Cookies without HTTP only
  • Missing Secure attribute
  • HTTPS method-Option Method enabled
  • Method interchange
  • Default server page disclosure
  • Server version disclosure
  • Trace.axd
  • Robots.txt, Sitemap.xml
  • Application error
  • Improper error handling
  • File path disclosure
  • IP address disclosure
  • Sensitive information disclosure
  • Sensitive information in URL
  • Autocomplete enabled
  • Session Fixation
  • Weak Session Management
  • Session not Validate after logout
  • Session Hijacking
  • Multi-login
  • Session Token in URL
  • Session Timeout
  • Unrestricted file upload
  • Insecure direct object reference
  • Insecure Download
  • Unauthorized access
  • Change password feature missing
  • Change password without old password
  • Absence of complex / Weak  password policy
  • Html 5 cross origin
  • Authorization Bypass
  • Weak encoding / encryption
  • Parameter Manipulation
  • Directory Listing, Indexing
  • Cache-able HTTPS
  • Default credentials
  • Default / admin page disclosure
  • Test page
  • Anti-automation
  • Blind SQL injection
  • Html injection
  • Invalidated redirect &Fwd
  • OTP bypass
  • Cross-domain referrer leakage
  • CSRF – Cross Site Request Forgery
  • XSS – Cross Site Scripting
  • SQL injection
  • Brute force
  • Account Lockout
  • Sensitive information in source code
  • User enumeration
Share with Friends
Use Cybytes and
Tip the Author!
Share with Friends
Ready to share your knowledge and expertise?
Comment on This

You must be logged in to post a comment.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Support Cybrary

Donate Here to Get This Month's Donor Badge


We recommend always using caution when following any link

Are you sure you want to continue?