A checklist you operate

Not docs to read. Expand a category, drill into a technology, and tick checks as you go. Progress and per-check notes are tracked at every level.

Find any check instantly

Press ⌘K from any page to search every platform, category, technology, check, tool, and reference. Select a result and it expands and highlights the exact check.

Private & offline

No accounts, no database, no telemetry. Your progress and findings live in your browser. Export to Markdown, CSV, Excel, or JSON, and re-import to resume.

Built to scale as data

Every check is a typed object. Add a check, a technology, or a whole platform by editing one data file, and the type system and CI validate it. The UI never changes.

The knowledge base behind the checklist

Powered by PentestingEverything

Every check in this tool is the operational front end of PentestingEverything, a dedicated knowledge base covering web, mobile, API, cloud, and every other platform in this checklist. The checklist covers what to test. PentestingEverything holds the deep how and why behind each one, kept close and in sync with the checks here.

Visit the website →View on GitHub2,065 checks mapped to one shared body of knowledge.

Every platform, one framework

Across 26 platforms, from web, API, and mobile to Active Directory, cloud, Kubernetes, LLM, and forensics. Each is its own checklist organised by category, technology, and check. Pick where you're testing and work top to bottom.

Web ApplicationAssess modern web apps end to end306 checks APIREST & GraphQL, OWASP API Top 10110 checks MobileiOS & Android, OWASP MASVS70 checks Thick ClientDesktop & native applications91 checks Secure Code ReviewSource-level vulnerability discovery89 checks CloudAWS, Azure, GCP misconfiguration87 checks DevSecOpsSecurity across the SDLC60 checks NetworkInfrastructure & service testing72 checks Wi-FiWireless network assessment67 checks FirewallPerimeter & ruleset testing56 checks Active DirectoryDomain enumeration to DA126 checks InfrastructureHosts, services & hardening51 checks MCP SecurityModel Context Protocol servers/tools70 checks LLM SecurityOWASP LLM Top 1066 checks Threat ModelingSTRIDE, attack trees, trust boundaries58 checks Configuration ReviewHardening & baseline review67 checks Containers & KubernetesImages, runtime & cluster security64 checks CI/CDPipeline & supply-chain attacks58 checks IoTDevice, firmware & radio68 checks BlockchainSmart contracts & Web355 checks Phishing AssessmentSocial-engineering campaigns66 checks OSINTOpen-source intelligence gathering60 checks ForensicsEvidence acquisition & analysis79 checks Red TeamObjective-based adversary simulation59 checks Physical SecurityBadge, lock & on-site access testing60 checks Supply Chain SecurityDependencies, build trust & provenance50 checks