“I always start out with trying to gather as much information as I can about the application and its immediate environment, any dependencies that it has or components that it interacts with on the backend.”

Transcript evidence from Daniel Ramsbrock -- Web Application Pen Testing – Part 2.