Tools/approach to pentest my own framework/SaaS?

i built a saas on custom php framework, running on test server. i would like to check how hackable the live deployment actually is - not just static code review. whats your go to stack for self pentesting a web app?