Web Application Penetration Testing Methodology

## Web Application Penetration Testing Methodology

Review the Autonomous Pentest methodology for web applications and the APIs that serve them.

Web application pentesting is a structured process in which an attacker simulates real-world attacks to identify security vulnerabilities in a web application. This ensures robust security controls, protects sensitive data, and strengthens overall application security.

Autonomous Pentest is a web/API penetration-testing agent that operates without human intervention. It drives a real browser and real HTTP tooling against a target application, reasons about what it finds, attempts to confirm weaknesses with concrete evidence, and produces a findings report. It follows an industry-standard methodology aligned with the **OWASP Top 10:2025** risks, the **CWE Top 25 (2025)** weakness classes, and the **Penetration Testing Execution Standard (PTES)** process model. Its approach combines automated crawling, scanning, and reasoning with an independent-review step so that reported findings are backed by recorded evidence.

A web application penetration test with Autonomous Pentest includes the following stages:

* [Target Scope Reconnaissance](https://docs.cobalt.io/en-us/articles/autonomous-web-methodologies-tT8tHV2r0u#h-target-scope-reconnaissance)


* [Authentication and Session Establishment](https://docs.cobalt.io/en-us/articles/autonomous-web-methodologies-tT8tHV2r0u#h-authentication-and-session-establishment)


* [Business and Application Logic Mapping](https://docs.cobalt.io/en-us/articles/autonomous-web-methodologies-tT8tHV2r0u#h-business-and-application-logic-mapping)


* [Vulnerability Analysis and Test Planning](https://docs.cobalt.io/en-us/articles/autonomous-web-methodologies-tT8tHV2r0u#h-vulnerability-analysis-and-test-planning)


* [In-Depth Vulnerability Testing and Exploit Review](https://docs.cobalt.io/en-us/articles/autonomous-web-methodologies-tT8tHV2r0u#h-in-depth-vulnerability-testing-and-exploit-review)


* [Advanced Security Testing for Modern Web Apps](https://docs.cobalt.io/en-us/articles/autonomous-web-methodologies-tT8tHV2r0u#h-advanced-security-testing-for-modern-web-apps)


* [Ongoing Assessment and Human-in-the-Loop Controls](https://docs.cobalt.io/en-us/articles/autonomous-web-methodologies-tT8tHV2r0u#h-ongoing-assessment-and-human-in-the-loop-controls)


* [Reporting, Triaging, and Retesting](https://docs.cobalt.io/en-us/articles/autonomous-web-methodologies-tT8tHV2r0u#h-reporting-triaging-and-retesting)


:::info
**Note:** The stages run in a fixed order — crawl, authenticate, make sense, plan, investigate — and the depth of the engagement is selected up front (see *Engagement depth* below). The tooling Autonomous Pentest uses within each stage may vary from test to test.

:::

During the assessment, Autonomous Pentest evaluates the application as an external (unauthenticated) and/or authenticated user would, identifying security flaws in business logic, authentication, authorization, and input handling. Testing is conducted for each provided credential set.

Standard web application tests include the APIs that serve application content. Because Autonomous Pentest is a **black-box web/API** pentester, it exercises the application over HTTP the way a user would; it does **not** analyze source code, binaries, or process memory. Weakness classes that only manifest in native/compiled code (buffer overflows, use-after-free, and similar) are outside its reach by design.

## Target Scope Reconnaissance

During this stage, Autonomous Pentest drives a real browser to map the target application and gather the information later stages depend on. Autonomous Pentest gathers and analyzes:

* Application URLs, routes, and reachable pages
* Business logic overview and key functionalities
* Input fields, hidden parameters, and dynamic pages
* Third-party libraries, CDN dependencies, and external service integrations

Autonomous Pentest confirms the following before proceeding:

* The ability to reach and exercise the target(s)
* Testing permissions and the authentication mechanisms in use
* Application functionality and the surfaces exposed to each role

## Authentication and Session Establishment

After crawling, Autonomous Pentest works out how the target authenticates and captures reusable credentials for the downstream stages. This stage is distinctive to Autonomous Pentest's design and underpins its evidence-quality controls:

* Determining the authentication flow for each supplied identity
* Establishing and validating an authenticated session per role
* Verifying session keepalive so authenticated testing remains stable
* Producing proxy-injected credentials that later, non-browser tooling authenticates through

**Credentials are never exposed to the reasoning model.** Login secrets are injected by a proxy; the agent only ever references a handle to a proxy, never the raw secret. Downstream tools authenticate through the injection proxy, so credentials never appear in a prompt, a probe, or a stored artifact.

## Business and Application Logic Mapping

Autonomous Pentest curates the raw observations from crawling and authentication into a usable picture of the application, marking scope, duplicates, and noise. It analyzes:

* **User Roles & Access Control Mapping:** how roles and identities map to the surfaces each can reach
* **Business Logic & Abuse Scenarios:** workflows that could be bypassed or abused
* **Session & Authentication Mechanisms:** how sessions are managed and where authentication is enforced
* **Client-Side vs. Server-Side Controls:** whether security is enforced on the server, not just the client
* **Surface Labeling:** marking out-of-scope, duplicate, and noisy surfaces so later stages focus effort where it matters

## Vulnerability Analysis and Test Planning

Autonomous Pentest proposes concrete candidate weaknesses to investigate, organized by weakness family. Each candidate is a testable hypothesis — not raw scanner output — carrying its rationale and the evidence expected to confirm or reject it. Candidates are consolidated for feasibility and de-duplicated before testing begins.

* Candidate weaknesses proposed per weakness family, each with rationale
* Expected evidence defined up front for each candidate
* Consolidation and feasibility review to remove duplicates and dead ends

## In-Depth Vulnerability Testing and Exploit Review

This stage actively probes each candidate to confirm or reject it with concrete evidence, going beyond what automated scanning alone can find. 

Testing in this stage spans the full set of web-reachable weakness families, including:

* **Injection:** SQL, NoSQL, OS command, template (SSTI), XML (XXE), LDAP, XPath, path traversal / LFI, remote file inclusion, CRLF/header injection, and AI/LLM prompt injection where the application integrates such components
* **Broken Access Control:** IDOR/BOLA, function-level authorization (BFLA), privilege escalation, forced browsing, and open redirect (OWASP Top 10:2025 #1; includes SSRF)
* **Authentication Failures:** JWT manipulation, OAuth/OIDC flow abuse, credential recovery and enumeration, session management, and authentication bypass
* **Cryptographic Failures:** weak or deprecated algorithms, insufficient randomness, and weak password hashing (CWE-327, CWE-330, CWE-916)
* **Security Misconfiguration:** missing or insecure security headers, verbose errors / information disclosure, exposed files and directories, HTTP parameter pollution, and CORS misconfiguration
* **Software & Data Integrity Failures:** insecure deserialization (CWE-502)
* **Insecure Design:** mass assignment, race conditions (TOCTOU), and missing rate limiting

## Advanced Security Testing for Modern Web Apps

For Single Page Applications and microservices, Autonomous Pentest performs additional tests, including:

* **Client-Side / DOM-Based Testing** — DOM-based cross-site scripting and client-side security issues
* **Cross-Origin Resource Sharing (CORS)** — exploitability of CORS misconfigurations
* **HTTP Request Smuggling** — desync and request-smuggling conditions
* **GraphQL Abuse** — authorization and abuse of GraphQL endpoints

## Ongoing Assessment and Human-in-the-Loop Controls

Throughout the engagement, Autonomous Pentest keeps a human operator in the loop for risky or out-of-scope actions and provides continuous visibility into its work:

* **Human-in-the-loop approval** — destructive writes, denial-of-service risk, and mass-request actions pause for operator sign-off. Engagements also pause after planning for plan approval by the human chaperone.
* **Scope enforcement** — post-exploitation activity (persistence, lateral movement, data exfiltration) is intentionally out of scope for an authorized, non-destructive application engagement.
* **Continuous evidence capture** — every probe is recorded as it happens, so results can be reviewed in real time.

## Reporting, Triaging, and Retesting

Autonomous Pentest reports confirmed findings with the evidence that supports them. Each finding includes:

* Minimal, numbered reproduction steps
* A representative request/response captured during testing
* The mapped weakness class and its OWASP/CWE references


---

## OWASP Top 10:2025 Coverage

The table maps the OWASP Top 10:2025 categories to what Autonomous Pentest tests.

| **OWASP 2025** | **Coverage** | **What Autonomous Pentest tests** |
|:---|:---|:---|
| **A01 Broken Access Control** *(now includes SSRF)* | ✅ Full | IDOR/BOLA, function-level authorization, privilege escalation, forced browsing, open redirect, **and SSRF** |
| **A02 Security Misconfiguration** | ✅ Full | Missing security headers, verbose errors, exposed files/directories, HTTP parameter pollution, CORS misconfiguration |
| **A03 Software Supply Chain Failures** | ✅ Partial | Vulnerable/outdated components, via an integrated dependency scanner. Broader supply-chain concerns (build/CI integrity) are outside black-box testing. |
| **A04 Cryptographic Failures** | ✅ Full | Weak algorithms, insufficient randomness, weak password hashing |
| **A05 Injection** | ✅ Full | SQL, NoSQL, OS command, template (SSTI), XML (XXE), LDAP, XPath, path traversal, file inclusion, CRLF/header, cross-site scripting, request smuggling, AI/LLM prompt injection |
| **A06 Insecure Design** | ✅ Partial | Mass assignment, race conditions (TOCTOU), missing rate limiting |
| **A07 Authentication Failures** | ✅ Full | JWT manipulation, OAuth/OIDC abuse, credential recovery/enumeration, session management, authentication bypass |
| **A08 Software & Data Integrity Failures** | ✅ Full | Insecure deserialization |
| **A09 Security Logging & Alerting Failures** | ⚠️ Limited | Only externally-observable symptoms (e.g. verbose errors). Logging/alerting gaps are largely not observable from outside the system. |
| **A10 Mishandling of Exceptional Conditions** *(new in 2025)* | ✅ Partial | Error-handling and information-disclosure symptoms, and fail-open authentication behavior. |

**Bonus — OWASP API Security Top 10.** Several weakness families also align with the API Top 10: **API1 (BOLA)**, **API5 (broken function-level authorization / GraphQL)**, and **API6 (mass assignment)**.

**Summary:** 6 of 10 categories are covered as full, first-class capabilities and 3 more partially. A09 is inherently limited for any black-box tester because logging/alerting failures are not externally observable.

## Alignment with PTES

The Penetration Testing Execution Standard defines seven phases. Autonomous Pentest's pipeline maps onto them as follows.

| **PTES phase** | **How Autonomous Pentest addresses it** | **Notes / limits** |
|:---|:---|:---|
| **1. Pre-engagement Interactions** | Scope, targets, login identities/roles, depth, and approval gates are agreed up front. | Rules of engagement are set by the operator, not by the agent. |
| **2. Intelligence Gathering** | Target Scope Reconnaissance (browser crawl per role) and Authentication. | Focused on the target application's own surface, not broad OSINT. |
| **3. Threat Modeling** | Business and Application Logic Mapping. | Application-level, driven by observed behavior. |
| **4. Vulnerability Analysis** | Vulnerability Analysis and Test Planning. | Candidates are testable hypotheses, not raw scanner output. |
| **5. Exploitation** | In-Depth Vulnerability Testing and Exploit Review. | Bounded by scope and human approval for risky actions. |
| **6. Post-Exploitation** | Evidence capture, reproduction steps, and independent validation. | Persistence, lateral movement, and exfiltration are intentionally out of scope / operator-gated. |
| **7. Reporting** | SARIF report plus per-identity results and findings with reproduction steps. | Machine-readable for downstream ingestion. |

## References

* OWASP Top 10:2025 — <https://owasp.org/Top10/2025/>
* OWASP API Security Top 10:2023 — <https://owasp.org/API-Security/>
* 2025 CWE Top 25 — <https://cwe.mitre.org/top25/archive/2025/2025_cwe_top25.html>
* PTES — <http://www.pentest-standard.org/>






Autonomous Web Methodologies

Cobalt Methodologies Overview

Web Methodologies

API Methodologies

External Network Methodologies

Internal Network Methodologies

Mobile Methodologies

Cloud Configuration Review Methodologies

Cloud Pentest Methodology

Desktop Methodologies

AI/LLM Methodologies

Digital Risk Assessment Methodology

Secure Code Review Methodologies

Methodologies

How to get started with Cobalt

Getting Started

Assets are what we pentest

Asset Types

Create an Asset

Risk Advisories

Assets

Pentests

Overview

Asset Details

Pentest Details

Scope & Test Period

Preparation

Create a Pentest

Launch a Saved Autonomous Pentest

Review a Closed Autonomous Pentest Report

Autonomous Pentests

Pentest Process

Pentest States

Coverage Checklist

Pentest Expectations

Complete an In-House Pentest (For Pentesters)

Set Up an In-House Pentest

In House Pentests

Remediate Findings

Finding States

Severity Levels

Findings

Contents of a Pentest Report

Customize Your Report

Co-branded Reports

Reports

Engagements Overview

Digital Risk Assessment

Secure Code Review

Engagements

Insights

Planning

Attack Surface Monitoring (ASM)

Attack Surface

DAST Scanner Overview

Best Practices

Integrations

Partial Scans: Reduced Scope

Scans

Sequence recorder

Targets

Target Authentication

Extra Hosts

Blackout Period

DAST Scanner

Account Overview

Account Settings

Password Best Practices

Sign In to Cobalt

Troubleshoot Sign-in Issues

User Account

Collaboration Overview

Collaborate on Pentests

Groups

Manage Pentest Collaborators

User Roles and Permissions

Manage Notifications

Collaboration

Organization Overview

Manage Users

Your Cobalt Contract

Configure SAML SSO

How to Configure SAML 2.0 for Cobalt 

SAML Migration: Update Your Configuration

SCIM Provisioning Setup Guide

Configure Organization Settings

Organization

Cobalt PtaaS Tiers

Cobalt Credits

Track Your Credits

Credits

Cobalt Integrations Overview

Connect your applications

Create Azure DevOps Work Item for Findings

Create GitHub tickets for Findings

Create GitLab tickets for Findings

Send email notifications for Findings from Outlook

Send MS Teams notifications for Findings

Create Jira tickets for Findings

HTTP Connector

Import Assets from Google Sheets

Map Cobalt Pentest Finding Severity to Jira Issue Priority

Modify Jira Issue Summary to contain Pentest Title

How to Guides

Troubleshooting

Integration Builder

Jira Cloud Integration

Jira Data Center Integration

Push Cobalt Findings to Jira

Synchronize Cobalt Severity Levels with Jira

Switching to a New Jira Instance

Troubleshoot Your Jira Integration

Integrate Jira with Cobalt

Slack

Microsoft Teams

Webhooks

DefectDojo

Kenna Security

Vanta

Carried Over Findings

Create Test Finding

Cobalt API Overview

Create a Personal Cobalt API Token

Get an Organization Token

Revoke Your Personal Cobalt API Tokens

Create or Modify an Asset

Import Findings to Google Sheets

Cobalt API

Glossary

May 2026

April 2026

March 2026

February 2026

January 2026

November 2025 

August 2025

July 2025

June 2025

May 2025

April 2025

March 2025

January 2025

December 2024

November 2024

October 2024

September 2024

August 2024

July 2024

June 2024

May 2024

April 2024

March 2024

January 2024

Product Updates

What's New

Guide

Cobalt Product Documentation

Autonomous Web Methodologies

Share

Share

Autonomous Web Methodologies

Share

Share