# Testing Checklist

The following is the list of items to test during the assessment:

Note: The `Status` column can be set for values similar to "Pass", "Fail", "N/A".

| Test ID           | Test Name                                                                  | Status | Notes |
|-------------------|----------------------------------------------------------------------------|--------|-------|
| **WSTG-INFO**     | **Information Gathering**                                                  |        |       |
| WSTG-INFO-01      | Conduct Search Engine Discovery and Reconnaissance for Information Leakage |        |       |
| WSTG-INFO-02      | Fingerprint Web Server                                                     |        |       |
| WSTG-INFO-03      | Review Webserver Metafiles for Information Leakage                         |        |       |
| WSTG-INFO-04      | Enumerate Applications on Webserver                                        |        |       |
| WSTG-INFO-05      | Review Webpage Content for Information Leakage                             |        |       |
| WSTG-INFO-06      | Identify Application Entry Points                                          |        |       |
| WSTG-INFO-07      | Map Execution Paths Through Application                                    |        |       |
| WSTG-INFO-08      | Fingerprint Web Application Framework                                      |        |       |
| WSTG-INFO-09      | Fingerprint Web Application                                                |        |       |
| WSTG-INFO-10      | Map Application Architecture                                               |        |       |
| **WSTG-CONF**     | **Configuration and Deploy Management Testing**                            |        |       |
| WSTG-CONF-01      | Test Network Infrastructure Configuration                                  |        |       |
| WSTG-CONF-02      | Test Application Platform Configuration                                    |        |       |
| WSTG-CONF-03      | Test File Extensions Handling for Sensitive Information                    |        |       |
| WSTG-CONF-04      | Review Old Backup and Unreferenced Files for Sensitive Information         |        |       |
| WSTG-CONF-05      | Enumerate Infrastructure and Application Admin Interfaces                  |        |       |
| WSTG-CONF-06      | Test HTTP Methods                                                          |        |       |
| WSTG-CONF-07      | Test HTTP Strict Transport Security                                        |        |       |
| WSTG-CONF-08      | Test RIA Cross Domain Policy                                               |        |       |
| WSTG-CONF-09      | Test File Permission                                                       |        |       |
| WSTG-CONF-10      | Test for Subdomain Takeover                                                |        |       |
| WSTG-CONF-11      | Test Cloud Storage                                                         |        |       |
| WSTG-CONF-12      | Testing for Content Security Policy                                        |        |       |
| WSTG-CONF-13      | Test Path Confusion                                                        |        |       |
| WSTG-CONF-14      | Test Other HTTP Security Header Misconfigurations                          |        |       |
| **WSTG-IDNT**     | **Identity Management Testing**                                            |        |       |
| WSTG-IDNT-01      | Test Role Definitions                                                      |        |       |
| WSTG-IDNT-02      | Test User Registration Process                                             |        |       |
| WSTG-IDNT-03      | Test Account Provisioning Process                                          |        |       |
| WSTG-IDNT-04      | Testing for Account Enumeration and Guessable User Account                 |        |       |
| WSTG-IDNT-05      | Testing for Weak or Unenforced Username Policy                             |        |       |
| **WSTG-ATHN**     | **Authentication Testing**                                                 |        |       |
| WSTG-ATHN-01      | Testing for Credentials Transported over an Encrypted Channel              |        |       |
| WSTG-ATHN-02      | Testing for Default Credentials                                            |        |       |
| WSTG-ATHN-03      | Testing for Weak Lock Out Mechanism                                        |        |       |
| WSTG-ATHN-04      | Testing for Bypassing Authentication Schema                                |        |       |
| WSTG-ATHN-05      | Testing for Vulnerable Remember Password                                   |        |       |
| WSTG-ATHN-06      | Testing for Browser Cache Weakness                                         |        |       |
| WSTG-ATHN-07      | Testing for Weak Password Policy                                           |        |       |
| WSTG-ATHN-08      | Testing for Weak Security Question Answer                                  |        |       |
| WSTG-ATHN-09      | Testing for Weak Password Change or Reset Functionalities                  |        |       |
| WSTG-ATHN-10      | Testing for Weaker Authentication in Alternative Channel                   |        |       |
| WSTG-ATHN-11      | Testing Multi-Factor Authentication (MFA)                                  |        |       |
| **WSTG-ATHZ**     | **Authorization Testing**                                                  |        |       |
| WSTG-ATHZ-01      | Testing Directory Traversal File Include                                   |        |       |
| WSTG-ATHZ-02      | Testing for Bypassing Authorization Schema                                 |        |       |
| WSTG-ATHZ-03      | Testing for Privilege Escalation                                           |        |       |
| WSTG-ATHZ-04      | Testing for Insecure Direct Object References                              |        |       |
| WSTG-ATHZ-05      | Testing for OAuth Weaknesses                                               |        |       |
| **WSTG-SESS**     | **Session Management Testing**                                             |        |       |
| WSTG-SESS-01      | Testing for Session Management Schema                                      |        |       |
| WSTG-SESS-02      | Testing for Cookies Attributes                                             |        |       |
| WSTG-SESS-03      | Testing for Session Fixation                                               |        |       |
| WSTG-SESS-04      | Testing for Exposed Session Variables                                      |        |       |
| WSTG-SESS-05      | Testing for Cross Site Request Forgery                                     |        |       |
| WSTG-SESS-06      | Testing for Logout Functionality                                           |