Website Vulnerability Cheat Sheet — penetration testing basics, without the consultancy

Reviewed October 25, 2026 — Ingenious AI security checks.

Key facts

• Most breaches start with boring flaws: unpatched components, exposed admin pages and broken access control — not zero-days.
• Industry penetration testing runs roughly $10,000 to $35,000 for a standard commercial engagement — a free scan first tells you whether you need one yet.
• Scan only what you own: authorisation is the legal line between testing and attacking.

What are the main website vulnerability families?

Website vulnerabilities cluster into a small set of families that scanners and penetration testing both hunt for. Broken access control lets users reach data or functions that were never meant for them; injection flaws let input become commands; misconfiguration exposes admin panels, debug pages and directory listings; and outdated components import other people's known, patched vulnerabilities into your site.

• Broken access control: admin or account pages reachable by guessing URLs or changing an ID in the address bar.
• Injection: SQL, command and template injection where form or URL input reaches the server unsanitised.
• Cross-site scripting (XSS): attacker content rendered into pages other users load.
• Security misconfiguration: debug modes, default credentials, directory listing, verbose error pages, missing security headers.
• Outdated components: CMS cores, plugins and libraries with published, patched vulnerabilities still running live.
• Authentication failures: no rate limiting on logins, weak password rules, session handling that never expires.
• Sensitive data exposure: public backups, .git folders, environment files and API keys reachable over HTTP.

What does a safe scan workflow look like?

1. Confirm ownership and scope: list the domains and subdomains you own and may legally test.
2. Map the surface: enumerate pages, forms, logins, uploads and APIs — you cannot protect what is not on the map.
3. Run automated checks for the known families: headers, TLS, outdated components, exposed files, common misconfigurations.
4. Triage by exploitability: internet-reachable plus no-authentication plus data access is fix-first; theoretical issues queue behind them.
5. Fix, then re-scan: a finding is only closed when the same check comes back clean.

When do you need human penetration testing?

Automated scanning finds the known patterns fast and cheaply. Hire human penetration testing when the site handles payments or sensitive personal data, when business logic itself is the asset (pricing, credits, approvals), or when a scan finding needs proof of real-world impact before leadership will fund the fix.

Run the free check

The fastest way to apply this cheat sheet is the free check on BreachHunter: it maps your public surface and checks it against the vulnerability families above. Start on the BreachHunter homepage, compare tiers on BreachHunter pricing, and keep the full hosted reference open at the Website Vulnerability cheat sheet on BreachHunter. Questions or orders: ask Ingenious AI on WhatsApp or email orders@getingeniousai.com.

Run the free check on BreachHunter → Open the hosted cheat sheet →