Web application penetration testing
Manual testing of your web application, focused on the logic and access-control flaws that automated scanners cannot see.
When you need it
- Before a product launch or major release
- An enterprise customer asks for a pentest report
- SOC 2, ISO 27001 or PCI DSS evidence
- After adding payments or personal data
What we test
We test your application as each type of user, and as someone with no account at all, following the OWASP Web Security Testing Guide and going beyond it where your business logic needs it.
Login, password reset, multi-factor authentication, session handling and account takeover routes.
Whether one user or role can see or change another user's data, the most common serious flaw we find.
Workflows that can be skipped, repeated or abused: pricing, approvals, limits and multi-step processes.
SQL and command injection, cross-site scripting, file upload and server-side request forgery.
How the test runs
- Scoping. URLs, number of user roles, test accounts for each role, and any areas to avoid.
- Environment. A staging environment that mirrors production is ideal; production testing is possible with care.
- Testing. Usually three to eight days depending on size and roles, with critical findings reported immediately.
- Report and debrief. Developer-ready findings with reproduction steps and fixes, a walkthrough, and one retest within 90 days.
Supports
- SOC 2
- ISO 27001
- PCI DSS
- Customer due diligence
Questions
Do you test the API behind the web app?
Yes, the API calls the application makes are tested as part of it. A separate API test is worth adding if the API is also used by partners or mobile apps.
Can you test in production?
Yes, carefully, but a staging environment with realistic data is safer and lets us test more aggressively.
Will the report work for our customers?
Yes. You get an executive summary you can share and a technical section for your developers, plus a retest confirming fixes.
Know exactly what your test will cost by tomorrow
Tell us what you need tested. You'll get questions or a fixed quote within three working days.