Learn
LoginRegister
← All playbooks

Professional workflow · AppSec

Web application assessment workflow

Objective

Deliver a scoped, evidence-backed assessment of a web app’s auth, access control, and injection surface with clear remediation.

Authorized scope

Only targets listed in the signed RoE (lab apps, staging with permission). No production without explicit written approval and change windows.

Prerequisites

  • Web fundamentals + Web Application Security course (or equivalent)
  • Burp/ZAP basics in a lab
  • Written Rules of Engagement (RoE)
Course →Roadmap L9 →

Step-by-step workflow

  1. Step 01

    Scope & kickoff

    • Confirm in-scope hosts, roles, test accounts, and out-of-scope actions
    • Agree evidence retention and disclosure channel
    • Snapshot starting time and tester identity

  2. Step 02

    Recon & mapping

    • Enumerate routes, parameters, and APIs from browser + proxy
    • Note auth flows (session, JWT, OAuth)
    • Build an application map (pages / APIs / roles)

  3. Step 03

    AuthN / AuthZ / injection

    • Test authentication and session handling
    • Probe IDOR / BOLA and privilege boundaries
    • Check injection classes relevant to the stack (lab only)

  4. Step 04

    Validate & document

    • Reproduce each finding with minimal steps
    • Capture request/response evidence (redact secrets)
    • Rate severity with impact + likelihood notes

  5. Step 05

    Report & retest plan

    • Write executive + technical sections
    • List remediations with owners
    • Define retest criteria

Expected evidence

  • Scope / RoE artifact
  • App map diagram or inventory
  • Proxy history excerpts (sanitized)
  • Finding write-ups with steps to reproduce
  • Remediation table

Checklist

  • RoE signed and saved
  • Test accounts documented
  • Out-of-scope respected
  • Every finding has evidence + remediation
  • Secrets redacted from report attachments

Reporting template

Title: Web application assessment — [target]
Scope: [hosts / roles / dates]
Executive summary: [risk narrative]
Findings:
  - ID / title / severity / affected asset
  - Steps to reproduce
  - Impact
  - Remediation
Retest plan: [criteria]
Appendix: evidence index

Remediation

  • Fix broken access control with server-side authorization checks
  • Parameterize queries / encode output; add CSP where appropriate
  • Harden session cookies and auth flows; enforce MFA for privileged roles
  • Track remediations to closure with retest

Related tools