Mapping a web application's attack surface: every entry point and the control it needs
Before you can secure a web application you need a list of everything an attacker can touch. A practical method to map inputs, authentication, sessions, file handling, APIs, admin paths and third parties, with the control each area needs.