domains / families / security / performing-web-application-penetration-test

performing-web-application-penetration-test

separate

'Performs systematic security testing of web applications following the

When to use

• Testing web applications before production deployment to identify exploitable vulnerabilities
• Conducting compliance-driven security assessments (PCI-DSS requirement 6.6, SOC 2 Type II)
• Validating remediation of previously identified web application vulnerabilities during retesting
• Assessing third-party web applications before integration into the organization's environment
• Evaluating custom-developed web applications where automated scanning alone is insufficient

When not to use

• web applications without written authorization
• production systems during peak traffic hours without explicit approval
• denial-of-service testing of web infrastructure

Skill page

Source