General Guidelines1 Map the Application's Content2 Analyze the Application3 Test Client-Side Controls4 Test the Authentication Mechanism5 Test the Session Management Mechanism6 Test Access Controls7 Test for Input-Based Vulnerabilities8 Test for Function-Specific Input Vulnerabilities9 Test for Logic Flaws10 Test for Shared Hosting Vulnerabilities11 Test for Application Server Vulnerabilities12 Miscellaneous Checks13 Follow Up Any Information Leakage