Penetration Testing Evaluation Checklist

Web Application Vulnerability Coverage Check

Check each attack surface below for whether it has been tested; mark untested ones as gaps:

Injection

• SQL Injection (login forms, search, API params, cookies)
• XPath Injection
• LDAP Injection
• Command Injection (OS Command Injection)
• SSTI (Server-Side Template Injection)
• XXE (XML External Entity Injection)

Cross-Site

• Reflected XSS (search box, URL params, error pages)
• Stored XSS (comments, feedback, user profiles)
• DOM XSS
• CSRF (transfers, password changes, critical operations)