Web Application Penetration Testing and Vulnerability Assessment
Core concepts
Distinguish vulnerability assessment (breadth, known signatures, prioritized findings) from penetration testing (depth, chained exploitation, business impact). Know the phases: scoping and rules of engagement, reconnaissance, mapping and enumeration, vulnerability discovery, exploitation with proof, post-exploitation, reporting, and retest. Understand black-box, gray-box, and white-box approaches and why authenticated testing finds far more access-control and business-logic flaws.
Methodology and evidence
Know the OWASP Testing Guide and WSTG-style coverage areas: authentication, session, access control, injection, business logic, and client-side. Understand false positives and how to confirm them, CVSS as a severity scoring system (base, temporal, environmental) and its limits, and the need for reproducible evidence (request/response, screenshots, timestamps). Know that business-logic flaws (price manipulation, workflow bypass, race conditions) rarely show up in scanners.
Traps
Questions claim a scanner "proves" exploitability, treat CVSS score as the sole prioritization input, or forget authorization/scope documentation. Another trap: confusing a retest with a full new assessment, or assuming a clean scan means no vulnerabilities.
Rule of thumb
No exploitation without written scope; no finding without reproducible evidence and a clear business impact.
Worked example
A scanner flags a possible SQLi on a parameter. The tester confirms it with a time-based payload in an authorized window, captures the request/response, and reports it with CVSS plus the data reachable, not just the tool output.