My employer has used an external consultant for penetration testing. The web development team not involved in the pentesting itself and we only received the results and suggestions on how to improve security, so I am not experienced in pentesting tools and methodology.
I'm now working on a website development privately and can't afford external pentesting at this stage. The website will contain a MySQL database with customer data. Payments will most likely be handled by using a third party to process them. I've begun researching some online pentesting tools, particularly in relation to SQL.
Are there specific tests, or a checklist, guide or standard methodology for testing the security of websites, which many consultants would follow as a minimum? Obviously this should be free-to-distribute material, not proprietary.
I fully appreciate that self-testing will never replace the expertise of a security consultant but I would like to try to do as much myself first and may eventually ask a consultant to perform further testing before we go live if appropriate.