VA and Penetration Test -- 3

Hi, we developed a new web portal and need to test it's security, so we need to:

- Perform a VA (Vulnerability Assessment) and generate a report containing the list of vulnerabilities found and the raccomended actions to fix them;
- Perform a Penetration Test and generate a report containing the list of issues found and the raccomended actions to fix them.

This is the list of common tests that must be executed (at least theese, but you can perform more tests):
Fingerprint web server software
Analyze HTTP headers for security misconfiguration
Check the security of HTTP cookies
Check the SSL certificate of the server
Check if the server software is affected by known vulnerabilities
Analyze robots.txt for interesting URLs
Check whether a client access file exists, and if it contains a wildcard entry (clientaccesspolicy.xml, crossdomain.xml)
Discover server configuration problems such as Directory Listing
Check if HTTP TRACK/TRACE methods are enabled
Crawl website
Check for SQL Injection
Check for Cross-Site Scripting
Check for Local File Inclusion and Remote File Inclusion
Check for OS Command Injection
Check for ASP Cookieless Cross-Site Scripting
Check for Server Side Request Forgery
Check for Open Redirect
Check for PHP Code Injection
Check for JavaScript Code Injection
Check for outdated JavaScript libraries
Find administrative pages
Check for sensitive files (archives, backups, certificates, key stores) based on hostname and some common words
Attempt to find interesting files / functionality
Check for information disclosure issues
Weak Password Submission Method
Clear Text Submission of Credentials
Verify Domain Sources
Check for commented code/debug messages
Find Login Interfaces
Sensitive Data Crawl

Before we assign you the job you should provide us:

- the name of the framework you'll use to perform the tests;
- an example of the reports you'll generate and give us;
- an example of one or more real reports generated for other tests previously performed for other customers.

After you completed the job you must:

- give us two fully deailed reports, as previously described, containing issues, causes and suggested remediations/fixes and help us fixing all found issues

thank you