OWASP Top 10 test cases, starting with the one that finds the most

Broken access control is the largest category in practice and the cheapest to test, which is why it leads this set. The core test is trivial: authenticate legitimately, then reference a resource that belongs to somebody else. What makes it productive is repeating it across every HTTP method and every route, because the ownership check is usually written on the read path where it gets exercised, and quietly omitted on update and delete. The administrative variant is equally common: a function protected by hiding its navigation link is fully reachable by anyone who requests the path directly.

Privilege escalation rarely looks like an attack. Mass assignment sends a request that is valid in every respect except that it includes a field the client should not control, so it appears in logs as an ordinary profile update. The same applies to a role held in a cookie, a token payload or local storage: if authorisation is decided from a value the client can edit, then editing it is not exploitation so much as using the feature. Both are single request checks and both are frequently absent from test plans that cover injection thoroughly.

Injection testing usually covers the obvious surface and misses the rest. Body fields get tested because they are visible in the interface. Path segments, headers, and especially sort and filter parameters are commonly passed into queries unchecked, because they feel like internal plumbing rather than user input. Stored payloads need the same breadth on output: a script stored in a display name is often correctly encoded on the page where it was entered and rendered raw in an admin view, a notification email or an export, because encoding was applied at input in one place rather than at render everywhere.

Finally, a large share of real findings are configuration rather than code. Secrets in a repository history, in a container image, in a build log or in a client bundle with source maps published. Debug endpoints and verbose error modes left enabled in a deployed environment. Default credentials on a management console. Dependencies with known exploitable vulnerabilities in a reachable path. None of these require a clever payload, all of them are found by looking, and the check has to run against the deployed configuration rather than against what the repository says the configuration should be.