Web application penetration testing
Test your web applications and APIs against real-world attacks, with guidance your developers can use.
The problem
Your application holds customer data, and scanners alone cannot judge whether its logic can be abused.
You are about to launch, or a customer has asked for a test before they sign.
What’s included
- Scoping and written authorisation
- Testing aligned to the OWASP Top 10
- Authentication and session management testing
- Business logic testing
- API endpoint testing
- Report with remediation guidance
Deliverables
- Rules of engagement document
- Executive summary
- Technical report with steps to reproduce
- Developer debrief
How it works
Assess & understand
We learn how the application works and agree scope, accounts and environment.
Design & plan
We map roles, functions and APIs, then plan tests around the real risks.
Implement & configure
We test by hand with supporting tools, within the agreed rules.
Test & handover
We deliver the report and walk developers through each finding.
Frequently asked questions
Should you test production or a staging copy?
A staging environment that matches production is usually safer. We will agree the best option with you during scoping.
Do you need test accounts?
Yes, for authenticated testing. We ask for accounts in each role so we can check that users stay within their permissions.
Can you review fixes after developers make them?
Yes. Our remediation support and retest service confirms that each finding is closed.
Ready to talk about web application penetration testing?
Tell us what you are planning and get a written list of next steps.