Reconnaissance: Subdomain enumeration, directory discovery, public information gathering.
Mapping & Analysis: Document application flows, endpoints, parameters, and authentication flows.
Automated Scanning: Run non-intrusive automated scanners to find likely issues.
Manual Testing: Focus on business logic flaws, chained vulnerabilities and authorization bypasses not found by automated tools.
Exploitation & PoC: Create non-destructive proofs-of-concept for confirmed issues.
Reporting: Deliver clear findings with risk ratings, PoCs, and remediation steps.