To perform penetration testing on web applications, the first and most essential step is the test configuration. At this stage, developers define the scope and goals of the testing project. This will help to get a better idea of how to perform the tests, covering web architecture, API elements, general infrastructure information, and many more.