Web application & API penetration testing — recon, auth, injection, access control, SSRF/XXE, GraphQL & more, mapped to MITRE ATT&CK