Home
Penetration testing
Web application penetration testing

Web application testing that finds what scanners miss

Manual testing against OWASP WSTG and ASVS: broken access control, business-logic abuse and the chained bugs that automated tools report as clean.

Get a quote See a sample report

What a web app test covers

01 · What we test

Where web apps actually break

We test against the OWASP Web Security Testing Guide and ASVS, by hand, so you find the flaws a scanner reports as “clean”.

Authentication & sessions

Access control

Insecure direct object references, privilege escalation, tenant isolation

Business logic

Workflow, pricing, quota and approval flaws unique to your application

Injection & the OWASP Top 10

SQL injection, cross-site scripting, SSRF, deserialisation and more

Scope your web app test

02 · What scanners miss

A scanner lists bugs. We find the ones that cost you money

Automated tools are good at known patterns. They can’t reason about your business. These are the flaws we find by hand.

Flaw

What a scanner sees

What a tester finds

Broken access control

Nothing — the request is valid HTTP

Changing one ID in the URL returns another customer’s invoice

Business-logic abuse

A normal checkout flow

Applying the same discount code a hundred times, or ordering at a negative price

Chained low-risk bugs

Three “informational” notes

The three combined give an attacker an admin session

Authorisation gaps

A 200 response

A standard user reaching an admin-only API that the UI hides

Find what scanners miss

03 · A sample finding

What a web finding looks like

Redacted from a real engagement. Proof, business impact and a fix for every issue.

Two-layer reportBoard summary plus a technical write-up with request/response proof for each finding.
Developer walkthroughA live session with your engineers so fixes land right the first time.
Free retestWe re-test fixed findings and attest to closure, included in the price.

Want the full sample report? Ask for it in the form and we’ll send it.

WEB-03Sample finding · redacted

IDOR exposes every customer’s invoice by changing one ID

SeverityHigh

CVSS7.5

StandardOWASP A01

Evidence

GET /api/v2/invoices/1042 → 200 (your invoice)
GET /api/v2/invoices/ → 200 (another tenant)

Business impact

Any logged-in user could read every customer’s billing data by iterating the invoice ID — a reportable data breach.

Fix

Enforce an ownership check on every object lookup server-side; don’t rely on unguessable IDs. Add access-control tests to CI.

Confirmed manually against two test tenants.Retest: fixed

See what you’d get

Starting from€5,000

Priced on application size and roles

A web application test starts here and scales with the number of user roles, features and APIs in scope. See penetration testing pricing.

Get a fixed quote

05 · Questions

Web application penetration testing FAQ

Get a quote

What’s the difference between a vulnerability scan and a web app penetration test?

A scan matches known signatures. A penetration test adds a human who reasons about your application’s logic, chains low-risk issues into real attacks, and validates every finding by hand. Scanners never find broken access control or business-logic abuse.

Do you follow OWASP?

Yes. We test against the OWASP Web Security Testing Guide (WSTG) and map coverage to the OWASP Top 10 and ASVS, so your report lines up with the framework your auditor or customer already knows.

Do you need source code?

No, but it helps. A grey-box test with a user login is the most common and finds the most for the budget. A white-box test with source code gives the deepest review of critical applications.

Can you test without disrupting production?

Yes. We prefer a staging environment that mirrors production. Where we test production, we agree windows and keep exploitation safe and non-destructive.

Does a web app test cover the API behind it?

We test the APIs your application calls as part of the engagement. If you expose a standalone or partner API, a dedicated API penetration test gives it the depth it needs.