Defining scope of web application pentest

Hi,

Can anyone please tell what needs to be considered while defining the 
scope of a web application penetration test. Here I am concerned only 
about the web application and the web server that would exclude every 
other bit related to the infrastructure (such as firewall or a proxy 
etc). Also how do we calculate the effort required to test a web 
application. The things which I think may be considered are the 
number of static and dynamic pages and types of users involved etc. 
But what else can be considered?

Any inputs would be highly appreciated.

Cheers
Vishal


-------------------------------------------------------------------------
Sponsored by: Watchfire 
Methodologies & Tools for Web Application Security Assessment 
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today! 

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------