Web Application Penetration Testing

A phased pentesting workflow for running web applications. Adapted from Shannon's pipeline (Keygraph, AGPL — concepts only, no code borrowed), built around three rules:

1. Every confirmed finding requires evidence. Report unverified candidates and blocked checks separately.
2. Bounded scope — every active request goes against a target the operator pre-declared. Off-scope hosts are refused.
3. A blocked test is not a clean bill of health. Stay within approved methods; do not expand exploitation to force a finding.

This skill is for authorized testing only — applications you own or have explicit written authorization to test. It complements, but does not replace, professional penetration testing.

🛑 STOP — do these three things before ANY scan