Web Application VAPT Checklist

A baseline checklist for Vulnerability Assessment and Penetration Testing (VAPT) across web services and APIs.

1. Authentication & Session Management

• Ensure JWTs use robust signing algorithms (reject none and symmetric key confusion).
• Enforce rate-limiting on /login, /register, and /forgot-password endpoints.
• Set HttpOnly, Secure, and SameSite=Lax or Strict on all authentication cookies.
• Validate session invalidation upon logout and password changes.

2. Authorization & Access Controls (IDOR / BOLA)

• Verify object-level permissions on UUID / integer resource identifiers.
• Test horizontal privilege escalation between users of identical roles.
• Test vertical privilege escalation from standard to admin privileges.
• Block access to hidden administrative routes and internal GraphQL queries.

3. Injection & Input Validation

• Audit SQL / NoSQL queries for parameterized statements and ORM escapes.
• Verify HTML sanitization for stored and reflected Cross-Site Scripting (XSS).
• Test Server-Side Request Forgery (SSRF) against internal metadata endpoints (169.254.169.254).
• Restrict file upload extensions, validate MIME types, and randomize filenames.

4. Transport & Header Security

• Configure Strict-Transport-Security: max-age=63072000; includeSubDomains; preload.
• Implement Content-Security-Policy with minimal trusted origins.
• Set X-Content-Type-Options: nosniff and X-Frame-Options: DENY.