OWASP/wstg
A structured framework for web application security testing, covering reconnaissance through post-test activities. Organized by testing category rather than vulnerability type, making it practical for both manual testers and those building test plans. Widely used as a reference standard in the industry.