Web application pentest
Authenticated and unauthenticated testing of your app's business logic, access control and data handling, following the OWASP Web Security Testing Guide.
- Typical length
- 5–10 testing days
- Approach
- Black, grey or white box
- Price
- From $3,500
What we test
- Broken access control and IDOR
- Authentication and session flaws
- Injection: SQL, NoSQL, command, template
- Business-logic abuse
- File upload and SSRF
Standards we follow
- OWASP Web Security Testing Guide (WSTG)
- OWASP Top 10
- OWASP ASVS 4.0
- CVSS 3.1 scoring
Issues we often find
Typical findings from this kind of test, written the way they appear in our reports.
- Changing an ID in a request returns another customer's data
- A password reset link keeps working after it was used
- An admin-only action can be called by a regular user
- Uploaded files are served from the main domain and run scripts
What we need from you
We send this checklist at kickoff so testing starts on day one.
- URL of the environment to test (staging or production)
- Two test accounts for each user role
- A short walkthrough of key workflows
- Testing window and an emergency contact
How the engagement runs
Scope
We agree on targets, test accounts, rules of engagement and testing windows. You get a fixed quote.
Recon
We map your attack surface: hosts, routes, roles, third-party services and data flows.
Exploit
Testers chain weaknesses the way a real attacker would and confirm impact without harming production.
Report
Findings are rated with CVSS 3.1, with proof, business impact and a clear fix for each one.
Retest
Once you have fixed an issue, we verify it and update its status in the report.
Attest
We issue a signed letter of attestation you can share with customers and auditors.
Essential pentest: $3,500
One application or API, up to 5 testing days, a retest and a signed letter of attestation. No extras.