Web Application Penetration Testing
Web application penetration testing for UK organisations, led by a senior tester and done by hand. We look for the access control, business logic and authentication flaws that scanners walk straight past.
What the Test Covers
A web application penetration test is an authorised attack on your website, customer portal or platform by someone who has taken the time to understand what it is for. The OWASP Top 10 is where the test starts, not where it stops. Automated tooling clears the ground first: outdated components, missing headers, the obvious injection points. The rest is manual, because the findings that change your risk position rarely have a neat category name.
Where the Serious Findings Are
Access control, more than anywhere else. A request carries an identifier the server trusts without checking it belongs to you. Change the order number and you see someone else’s order. Change the account ID and you read another customer’s data. An admin function hidden from the menu still answers when it is called directly. Business logic is the other half. A discount applied twice, checkout steps taken out of order, two requests racing to spend the same balance. Every request is valid and the application does exactly what it was told. No scanner can tell you that what it was told is wrong.
What We Need From You
An account at every permission level. Most serious findings are about what one role can reach that it should not, so testing a login protected application without logins covers very little of it. Tell us about anything fragile and we will schedule around it.
What You Get From the Test
Findings That Are Real
Every finding is confirmed by hand before it reaches the report, with the request and response that prove it. Nothing is padded out with scanner output.
Fixes Your Developers Can Use
Each finding names the affected endpoint, the steps to reproduce it and a fix specific to how your application is built.
Evidence That Stands Up
A summary your board can read and a retest that confirms the fixes worked. That is what auditors, insurers and enterprise customers ask to see.
How the Test Runs
Before testing starts we agree the scope in writing: the URLs, the user roles and anything that must be left alone. The tester maps the application, every login flow, form, upload and API call behind the interface, then runs automated tooling to build a baseline. Most of the time goes on manual work. Each role is tested against every other role. Sessions are checked from login to logout, including password reset and multi factor authentication. Input is pushed into the places developers tend to build queries by hand, such as search filters, reports and exports. The API underneath is tested directly, because if it does not repeat every check the interface makes, the interface is a suggestion rather than a control. Anything critical is reported to you the moment it is confirmed, so the worst problems are being fixed before the test ends.
At a Glance
Reconnaissance & Scoping
Scope agreed in writing, then every page, role, form and API call mapped.
Automated Scanning
Tooling clears the ground: known components, missing headers and obvious injection points.
Manual Testing
Access control between roles, session handling, password reset and business logic, tested by hand.
Attack Simulation
Confirmed issues chained together to show what an attacker could reach with them.
Report & Retest
Risk rated findings with proof of concept evidence. Free retest included.
Findings appear in your client portal as we find them. Our day rate is published on the pricing page.
You May Also Be Interested In
Frequently Asked Questions
How long does a web application penetration test take?
Most take between three and ten days. A simple site with a few forms sits at the short end. A platform with several user roles, an API and payment or account logic sits at the long end. The number of roles matters more than the number of pages, because each role has to be tested against the others. The days are agreed and priced before we start.
Do you test against the OWASP Top 10?
Yes. Every web application test covers the whole OWASP Top 10, including broken access control, injection, authentication failures and security misconfiguration. We treat it as the minimum. Logic flaws and access control problems specific to your application never appear on a generic list, which is why most of the test is done by hand.
Will the testing affect my live website?
It should not. We can test in staging or production, whichever suits you. If the work has to run against production we agree the timing with you and keep the noisier tests to quieter hours. Critical findings are reported the moment they are confirmed rather than held back for the final report.
What does the report include?
Two parts. A summary for management that sets out the overall risk and what it means for the business, with no tool output or jargon. Then the technical detail for your developers: each finding rated by severity, with the evidence that proves it, the steps to reproduce it and the fix. Findings also appear in your client portal as testing runs, so nobody waits for the final report to start work. A free retest confirms the fixes held.