Awesome

OWASP Web Application Security Testing Checklist

Available in PDF or Docx for printing
Trello Board to copy yours

Table of Contents

Information Gathering
Configuration Management
Secure Transmission
Authentication
Session Management
Authorization
Data Validation
Denial of Service
Business Logic
Cryptography
Risky Functionality - File Uploads
Risky Functionality - Card Payment
HTML 5

<a name="Information">Information Gathering</a>

<a name="Configuration">Configuration Management</a>

Check for commonly used application and administrative URLs
Check for old, backup and unreferenced files
Check HTTP methods supported and Cross Site Tracing (XST)
Test file extensions handling
Test for security HTTP headers (e.g. CSP, X-Frame-Options, HSTS)
Test for policies (e.g. Flash, Silverlight, robots)
Test for non-production data in live environment, and vice-versa
Check for sensitive data in client-side code (e.g. API keys, credentials)

<a name="Transmission">Secure Transmission</a>

Check SSL Version, Algorithms, Key length
Check for Digital Certificate Validity (Duration, Signature and CN)
Check credentials only delivered over HTTPS
Check that the login form is delivered over HTTPS
Check session tokens only delivered over HTTPS
Check if HTTP Strict Transport Security (HSTS) in use

<a name="Authentication">Authentication</a>

<a name="Session">Session Management</a>

<a name="Authorization">Authorization</a>

Test for path traversal
Test for bypassing authorization schema
Test for vertical Access control problems (a.k.a. Privilege Escalation)
Test for horizontal Access control problems (between two users at the same privilege level)
Test for missing authorization

<a name="Validation">Data Validation</a>

<a name="Denial">Denial of Service</a>

Test for anti-automation
Test for account lockout
Test for HTTP protocol DoS
Test for SQL wildcard DoS

<a name="Business">Business Logic</a>

<a name="Cryptography">Cryptography</a>

Check if data which should be encrypted is not
Check for wrong algorithms usage depending on context
Check for weak algorithms usage
Check for proper use of salting
Check for randomness functions

<a name="File">Risky Functionality - File Uploads</a>

Test that acceptable file types are whitelisted
Test that file size limits, upload frequency and total file counts are defined and are enforced
Test that file contents match the defined file type
Test that all file uploads have Anti-Virus scanning in-place.
Test that unsafe filenames are sanitised
Test that uploaded files are not directly accessible within the web root
Test that uploaded files are not served on the same hostname/port
Test that files and other media are integrated with the authentication and authorisation schemas

<a name="Card">Risky Functionality - Card Payment</a>

<a name="HTML">HTML 5</a>

Test Web Messaging
Test for Web Storage SQL injection
Check CORS implementation
Check Offline Web Application

Source: OWASP