Cybersecurity
Web application penetration testing
Most serious web application flaws are about logic and access control, not obscure bugs. We test as each type of user, then try to cross the lines between them.
The problem this service solves
Web applications change often, and each release can open a door that was shut last month. Automated scanners handle injection and misconfiguration well. They do not understand that an auditor role should not be able to export all users.
Broken access control sits at the top of OWASP Top 10:2025 for a reason: it is common, hard to scan for, and expensive when exploited. Our testing concentrates there, then covers the rest of the standard categories.
What is in scope
-
Authentication
Login, registration, password reset, multi-factor flows, single sign-on and account recovery.
-
Authorization
Horizontal and vertical privilege escalation, object-level access, function-level access and role boundaries.
-
Session management
Token handling, expiry, fixation, logout behavior and cross-site request forgery protections.
-
Input handling
Injection (SQL, NoSQL, command, template), cross-site scripting, deserialization and file upload.
-
Business logic
Workflow bypass, price and quantity manipulation, race conditions, abuse of limits and rewards.
-
Security configuration
Headers, error handling, exposed debug features, TLS settings and third-party scripts.
-
Software supply chain
Outdated components with known issues, build artifacts and exposed source maps.
-
Client-side behavior
Sensitive data in browser storage, unsafe DOM handling and cross-origin messaging.
How the work runs
Understand
Learn how the application is meant to behave.
-
1
Application walkthrough
Roles, data flows, tenant boundaries and the features that matter most to the business.
-
2
Threat modeling
Short, focused modeling to decide where manual time is spent.
Test
Work through the categories as each role.
-
3
Role-based testing
Repeat key actions as each role, anonymous visitor and cross-tenant user, comparing responses.
-
4
Manual exploitation
Test injection points, workflow abuse and edge cases with an intercepting proxy and custom scripts.
-
5
Chaining
Combine smaller issues into realistic impact scenarios.
Report
Give developers what they need.
-
6
Findings with proof
Requests and responses, screenshots and steps to reproduce.
-
7
Fix guidance
Code-level and design-level remediation suited to your stack.
-
8
Retest
Confirm each fix, and look for the same flaw elsewhere in the application.
What you receive
- Executive summary
- Findings mapped to OWASP Top 10:2025 categories
- Reproduction steps and request/response evidence
- Remediation guidance by finding
- Access-control matrix showing what each role could and could not do
- Retest report
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Test accounts for every role, in at least two tenants if multi-tenant
- A staging environment or agreed production limits
- API documentation or a Postman collection, if available
- Notes on features that carry the most business risk
What this service is not
- A code review (that is a separate source-code assessment)
- A load or denial-of-service test
- A guarantee of freedom from vulnerabilities
What changes afterwards
- Developers can reproduce and fix each finding
- Role boundaries are checked rather than assumed
- Common flaws are fixed at the pattern level, not one endpoint at a time
Questions people ask
Do you test single-page applications?
Yes. We test the front end for client-side issues and the API behind it for server-side flaws. The API is usually where the important findings are.
Can you test behind single sign-on?
Yes. We need test accounts that can sign in through your identity provider and we include the sign-in flow in scope when you want it tested.
What do you do about WAF blocking?
We discuss it during scoping. Often we test with the WAF in place to see what it stops, and separately confirm the application behind it is sound.
Related
-
API penetration testing
Testing REST, GraphQL and internal APIs for broken authorization, tenant isolation failures, token weaknesses and business-logic abuse.
-
Penetration testing
Authorized, manual testing of applications, networks, cloud and identities to show what an attacker could reach and what to fix first.
-
LLM security assessments
Test chatbots, copilots and LLM-backed features for prompt injection, data leakage, unsafe output handling and excessive permissions.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response