Web Pentest (authorized, active)

Scope

Authorized security testing of web services — your own products and client engagements. Default target pattern: React/Vite SPA behind a CDN, JWT session tokens issued by an auth service (e.g. a messaging-bot handoff), nginx /gated/ content backend, PAT-scoped /api/v1, an admin DB behind it. The methodology generalizes to any SPA + serverless stack. Only test services the user owns or has written authorization for. No authorization yet → passive recon only (no active probes).

Naming note: the Phase 0–7 numbers below are steps of this methodology, not phases of a specific engagement. Engagement documents number phases their own way — read the two numberings separately: a skill Phase is not an engagement phase.

Ground rules