Web penetration testing starts long before you open Burp Suite. Here’s how I structure my first engagements:

Reconnaissance

Passive recon first — subdomains, tech stack, headers, and public info. Then targeted active scanning with Nmap and directory brute-forcing with Gobuster.

Mapping the attack surface

I document every endpoint, parameter, and auth flow. This is where OWASP Top 10 becomes a checklist rather than theory:

• Injection (SQLi, command injection)
• Broken authentication and session management
• XSS and CSRF

Exploitation and reporting

Findings get validated, reproduced, and scored with CVSS. A good report separates what was found from what matters to the business.

The goal isn’t just shells — it’s actionable remediation advice.