This is the most important section of this chapter, because it will allow you to structure your tests. A challenge that a typical pen tester will face is everyone telling them to refer to the OWASP checklist for web intrusion tests. But, the big questions that all testers will ask themselves are, where do I start? How do I proceed with the checklist? Before I get into the steps, let's take a look at an image of this workflow, a picture worth a thousand words. My workflow is based on a proxy-based tool: Burp Pro. Please refer to Chapter 4, All About Using Burp Suite at the beginning of this book for more details:
- The first step is not mentioned in the preceding diagram; it's the web server vulnerability assessment, which we discussed in the previous chapter.
- The second step is to fire Burp and make sure that the intercept is on in the Proxy...
