PentestingChecklist: practical security assessment checklists

A checklist you operate

Not docs to read. Expand a category, drill into a technology, and tick checks as you go. Progress and per-check notes are tracked at every level.

Find any check instantly

Press ⌘K from any page to search every platform, category, technology, check, tool, and reference. Select a result and it expands and highlights the exact check.

Private & offline

No accounts, no database, no telemetry. Your progress and findings live in your browser. Export to Markdown, CSV, Excel, or JSON, and re-import to resume.

Built to scale as data

Every check is a typed object. Add a check, a technology, or a whole platform by editing one data file, and the type system and CI validate it. The UI never changes.

Every platform, one framework

Across 23 platforms, from web, API, and mobile to Active Directory, cloud, Kubernetes, LLM, and forensics. Each is its own checklist organised by category, technology, and check. Pick where you're testing and work top to bottom.

Web ApplicationAssess modern web apps end to end299 checks APIREST & GraphQL, OWASP API Top 1075 checks MobileiOS & Android, OWASP MASVS53 checks Thick ClientDesktop & native applications68 checks Secure Code ReviewSource-level vulnerability discovery89 checks CloudAWS, Azure, GCP misconfiguration68 checks DevSecOpsSecurity across the SDLC60 checks NetworkInfrastructure & service testing72 checks Wi-FiWireless network assessment67 checks FirewallPerimeter & ruleset testing56 checks Active DirectoryDomain enumeration to DA126 checks InfrastructureHosts, services & hardening51 checks MCP SecurityModel Context Protocol servers/tools68 checks LLM SecurityOWASP LLM Top 1065 checks Threat ModelingSTRIDE, attack trees, trust boundaries58 checks Configuration ReviewHardening & baseline review67 checks Containers & KubernetesImages, runtime & cluster security64 checks CI/CDPipeline & supply-chain attacks58 checks IoTDevice, firmware & radio68 checks BlockchainSmart contracts & Web355 checks Phishing AssessmentSocial-engineering campaigns66 checks OSINTOpen-source intelligence gathering60 checks ForensicsEvidence acquisition & analysis79 checks