Web application penetration testing
Your web application, tested like an attacker would test it.
Manual testing of authentication, access control, data handling and business logic, beyond what scanners find.
Why teams call us
Problems this solves
-
01
Users can see each other's data
Broken access control is the most common serious web flaw, and scanners rarely find it.
-
02
Business logic nobody tested
Discounts, approvals, refunds and workflows can often be abused in ways automated tools cannot imagine.
-
03
A customer security questionnaire
Buyers want proof the application was tested recently by someone independent.
-
04
Legacy code with unknown risk
Older applications may carry injection, outdated libraries or weak session handling.
Our approach
We test the application as each type of user would use it: anonymous visitor, ordinary user, administrator and anything in between. Testers look for the OWASP Top 10 risks and verify controls against OWASP ASVS, but the most valuable findings usually come from understanding how your application is meant to work and then trying to break those rules.
You receive findings ranked by real risk, each with reproduction steps, evidence and specific guidance for your framework, followed by a retest once fixes are in place.
What is included
-
Access control testing
Horizontal and vertical privilege checks across every role and object.
-
Authentication and sessions
Login, password reset, MFA, session and token handling.
-
Injection testing
SQL, command, template and other injection classes, plus cross-site scripting.
-
Business-logic testing
Workflows, limits, prices and approvals tested for abuse.
-
File upload and storage
Upload validation, storage locations and direct object access.
-
Client-side security
Content Security Policy, cookies, third-party scripts and exposed secrets.
What you receive
- Test plan by user role
- Findings with screenshots and requests
- CVSS risk rating per finding
- Framework-specific fix guidance
- Retest and closure report
- Debrief with developers
Technology we work with
- OWASP Top 10
- OWASP ASVS
- Burp Suite
- Laravel
- Node.js
- React
- .NET
- Java
Industries
How an engagement runs
Every engagement starts with a signed agreement and an advance payment as set out in your proposal. Work begins once both are complete.
-
01
Scope
URLs, roles, test accounts, environments and exclusions agreed in writing.
-
02
Map
The application is explored and every function and role documented.
-
03
Test
Manual and tool-assisted testing across the agreed scope.
-
04
Report and retest
Findings delivered and discussed; fixes retested.
Ready to start? Talk to us directly.
Tell us what you need in a few lines. A specialist replies with next steps and a written proposal before any work begins.
Frequently asked questions
Can't find your answer? Ask us
Do you test in production or staging?
What do you need from us?
Do you fix the issues too?
Is a scan enough?
Start with a conversation.
Share a few details. A specialist replies with next steps, usually starting with a short call.