My two cents for web pentesting, based on OWASP WSTG v4.2