Web application penetration testing can be a big undertaking. Failing to plan is planning to fail; it is essential that we have a well-defined process or testing framework in place that is both well understood by our technical team, as well as sanctioned by the customer's management for use in their environment. Pen testing inevitably forces us to understand some non-technical aspects of the job too. When we are targeting applications we do not own, across infrastructures that are provided by third parties, we will most certainly have to abide by the various rules and ethical norms of those many stakeholders. There are a lot of different angles to achieving this understanding, so at the very least this should be a deliberate and a well-thought out process.
In this chapter, we took a look at some of the more prevalent testing methodologies and frameworks that we can...