Web Application Pentest Methodology (OWASP WSTG)

A professional web app assessment follows a methodology, not an ad-hoc tool run. The OWASP Web Security Testing Guide (WSTG) structures this into phases: information gathering and mapping the application's full attack surface (every input, every role, every state transition — not just the obvious login form), configuration and deployment testing (exposed admin interfaces, verbose error messages, outdated components), and then systematic testing of each vulnerability class against every relevant endpoint.

The discipline that separates a thorough assessment from a shallow one: testing the same vulnerability class across every input and role, not stopping after finding one instance. A single XSS finding often means the same unsafe pattern exists in a dozen other places the client needs to know about.