Information Gathering
• Manually explore the site
• Spider/crawl for missed or hidden content
• Check the Webserver Metafiles for information leakage files that expose content, such as robots.txt, sitemap.xml, .DS_Store
• Check the caches of major search engines for publicly accessible sites
• Check for differences in content based on User Agent (eg, Mobile sites, access as a Search engine Crawler)
• Check The Webpage Comments and Metadata for Information Leakage
• Check The Web Application Framework
• Perform Web Application Fingerprinting
• Identify technologies used
• Identify user roles
• Identify application entry points
• Identify client-side code
• Identify multiple versions/channels (e.g. web, mobile web, mobile app, web services)
• Identify co-hosted and related applications
• Identify all hostnames and ports
• Identify third-party hosted content
Configuration Management
• Check for commonly used application and administrative URLs
• Check for old, backup and unreferenced files
• Check HTTP methods supported and Cross Site Tracing (XST)
• Test file extensions handling
• Test RIA cross domain policy
• Test for security HTTP headers (e.g. CSP, X-Frame-Options, HSTS)
• Test for policies (e.g. Flash, Silverlight, robots)
• Test for non-production data in live environment, and vice-versa
• Check for sensitive data in client-side code (e.g. API keys, credentials)
Secure Transmission
• Check SSL Version, Algorithms, Key length
• Check for Digital Certificate Validity (Duration, Signature and CN)
• Check credentials only delivered over HTTPS
• Check that the login form is delivered over HTTPS
• Check session tokens only delivered over HTTPS
• Check if HTTP Strict Transport Security (HSTS) in use
Authentication
• Test for user enumeration
• Test for authentication bypass
• Test for brute force protection
• Test for Credentials Transported over an Encrypted Channel
• Test password quality rules
• Test remember me functionality
• Test for autocomplete on password forms/input
• Test password reset and/or recovery
• Test password change process
• Test CAPTCHA
• Test multi factor authentication
• Test for logout functionality presence
• Test for cache management on HTTP (eg Pragma, Expires, Max-age)
• Test for default logins
• Test for user-accessible authentication history
• Test for out-of channel notification of account lockouts and successful password changes
• Test for consistent authentication across applications with shared authentication schema / SSO and alternative channels
• Test for Weak security question/answer
Session Management
• Establish how session management is handled in the application (eg, tokens in cookies, token in URL)
• Check session tokens for cookie flags (httpOnly and secure)
• Check session cookie scope (path and domain)
• Check session cookie duration (expires and max-age)
• Check session termination after a maximum lifetime
• Check session termination after relative timeout
• Check session termination after logout
• Test to see if users can have multiple simultaneous sessions
• Test session cookies for randomness
• Confirm that new session tokens are issued on login, role change and logout
• Test for consistent session management across applications with shared session management
• Test for session puzzling
• Test for CSRF and clickjacking
Authorization
• Test for path traversal
• Test for vertical Access control problems (a.k.a. Privilege Escalation)
• Test for horizontal Access control problems (between two users at the same privilege level)
• Test for missing authorisation
• Test for Insecure Direct Object References
Data Validation
• Test for Reflected Cross Site Scripting
• Test for Stored Cross Site Scripting
• Test for DOM based Cross Site Scripting
• Test for Cross Site Flashing
• Test for HTML Injection
• Test for SQL Injection
• Test for LDAP Injection
• Test for ORM Injection
• Test for XML Injection
• Test for XXE Injection
• Test for SSI Injection
• Test for XPath Injection
• Test for XQuery Injection
• Test for IMAP/SMTP Injection
• Test for Code Injection
• Test for Expression Language Injection
• Test for Command Injection
• Test for Overflow (Stack, Heap and Integer)
• Test for Format String
• Test for incubated vulnerabilities
• Test for HTTP Splitting/Smuggling
• Test for HTTP Verb Tampering
• Test for Open Redirection
• Test for Local File Inclusion
• Test for Remote File Inclusion
• Compare client-side and server-side validation rules
• Test for NoSQL injection
• Test for HTTP parameter pollution
• Test for auto-binding
• Test for Mass Assignment
• Test for NULL/Invalid Session Cookie
Denial of Service
• Test for anti-automation
• Test for account lockout
• Test for HTTP protocol DoS
• Test for SQL wildcard DoS
Business Logic
• Test for feature misuse
• Test for lack of non-repudiation
• Test for trust relationships
• Test for integrity of data
• Test segregation of duties
• Test for Process Timing
• Test Number of Times a Function Can be Used Limits
• Test for the Circumvention of Work Flows
• Test Defenses Against Application Mis-use
• Test Upload of Unexpected File Types
Cryptography
• Check if data which should be encrypted is not
• Check for wrong algorithms usage depending on context
• Check for weak algorithms usage
• Check for proper use of salting
• Check for randomness functions
Risky Functionality – File Uploads
• Test that acceptable file types are whitelisted
• Test that file size limits, upload frequency and total file counts are defined and are enforced
• Test that file contents match the defined file type
• Test that all file uploads have Anti-Virus scanning in-place.
• Test that unsafe filenames are sanitized
• Test that uploaded files are not directly accessible within the web root
• Test that uploaded files are not served on the same hostname/port
• Test that files and other media are integrated with the authentication and authorization schemas
Risky Functionality – Card Payment
• Test for known vulnerabilities and configuration issues on Web Server and Web Application
• Test for default or guessable password
• Test for non-production data in live environment, and vice-versa
• Test for Injection vulnerabilities
• Test for Buffer Overflows
• Test for Insecure Cryptographic Storage
• Test for Insufficient Transport Layer Protection
• Test for Improper Error Handling
• Test for all vulnerabilities with a CVSS v2 score > 4.0
• Test for Authentication and Authorization issues
• Test for CSRF
HTML 5
• Test Web Messaging
• Test for Web Storage SQL injection
• Check CORS implementation
• Check Offline Web Application
Error Handling
• Check for Error Codes
• Check for Stack Traces
Most material derived from lists here: https://www.owasp.org/index.php/Web_Application_Security_Testing_Cheat_Sheet