Web application pentest

Web application penetration testing, before attackers do it for you.

Your website, customer portal, SaaS product or API, tested the way a real attacker would: manually, with every finding proven and paired with a concrete fix.

Built for SMEs that handle customer data online and need proof their application holds up.

Book a free 30-min callWhat I test
At a glance
Targets
Web apps · APIs · customer portals
Approach
Black, grey or white box
Reference
OWASP WSTG · OWASP Top 10
Deliverable
Report, debrief and retest
01 / Scope

What I test

Coverage follows the OWASP Web Security Testing Guide, adapted to what your application actually does.

Authentication and sessions

Login, password reset, MFA, session handling: every way an attacker could take over an account.

Access control

Can a customer see another customer’s invoices? Can a basic user reach admin features? The most common critical flaw.

Injection and input handling

SQL, command and template injection, cross-site scripting, file upload abuse and unsafe redirects.

APIs and business logic

REST and GraphQL endpoints, rate limits, and the workflows attackers abuse: payments, coupons, approvals.

02 / Method

How a web application pentest runs

Fixed scope, fixed price, no surprises.

  1. Scoping. URLs, user roles, environments, test accounts and time windows, all agreed in writing.
  2. Mapping. Every page, role and API call is mapped to understand what the application really exposes.
  3. Manual testing. Scanners only help cover ground. Every finding is verified by hand and proven, with no false positives left in the report.
  4. Report. An executive summary, then each finding ranked by risk with steps to reproduce and a concrete fix for your developers.
  5. Debrief and retest. We review the results together, then I check your fixes so you can show the risk is closed.
03 / Typical findings

What SME applications often get wrong

The most damaging issues are rarely exotic. These come up again and again.

Broken access control

Changing an ID in the URL shows another customer’s data. Easy to exploit, easy to miss in code review.

Weak admin protection

Admin panels reachable from the internet, without MFA, sometimes with default or shared credentials.

Exposed secrets

API keys in front-end code, verbose error messages, forgotten test endpoints and backups left online.

Outdated components

Frameworks, libraries and plugins with publicly known vulnerabilities that attackers scan for automatically.

04 / FAQ

Web application pentest: your questions

Will the test break my application?

Testing is designed not to. Dangerous actions such as mass deletion or denial of service are excluded unless you ask for them, and time windows and contacts are agreed in advance.

Should we test production or staging?

A staging environment that mirrors production is ideal. If you do not have one, production can be tested with dedicated test accounts and agreed precautions.

Do you need access to the source code?

No. A black-box or grey-box test with user accounts is the usual starting point. Access to code or documentation (white box) lets me go deeper in the same time.

Is a retest included?

Yes. Once you have fixed the findings, I verify the fixes and update the report, so you can show your clients or auditors the risk is closed.

Ready to test your application?

Tell me what the application does and who uses it. You get a fixed-price proposal after a free 30-minute call.

Book a free callAll services