What is web application penetration testing?
Web application penetration testing finds the ways an attacker could misuse your web application: to get in without an account, to see or change data they should not, or to take over other users. Incursion tests customer portals, internal applications, SaaS products and e-commerce sites for UK organisations, authenticated and unauthenticated, using named consultants who hold UK Cyber Security Council professional titles.
What we test
Authentication and session management: login, password reset, multi-factor authentication, session handling and token security.
Access control: whether users can reach data or functions belonging to other users or higher roles.
Input handling: injection (SQL, command, template and others), cross-site scripting, file upload and deserialisation.
Business logic: the flaws scanners cannot find, such as skipping payment steps, manipulating prices or abusing workflows.
Configuration: headers, TLS, error handling, exposed administrative interfaces and third-party components.
The APIs behind the application, where in scope; see API testing for API-only engagements.
Why it matters
Web applications are the most exposed part of most organisations and the most common route to a data breach. They change often, which means last year’s test tells you little about this year’s release. Testing is aligned to the OWASP Testing Guide and covers the OWASP Top 10, but is not limited to it: the serious findings are usually in business logic and access control, which only a person can test.
How we run it
Scoping. Your account manager and an active penetration tester work with you to agree the scope of your test on a scoping call. The quote is fixed to it.
Testing. A named, suitably qualified consultant does the work, and you get a direct line to them before, during and after the engagement. Critical and high-risk issues are verified and reported immediately.
Reporting. Easily digestible summaries sum up the whole engagement and support detailed technical findings, written so your team can replicate and fix them. Delivered within 5 working days.
Free retesting. One day of free retesting for every five days of consultancy, taken within 90 days of report delivery, so you can be sure the fixes worked.
Scoping notes
We test with two accounts for every user role in scope, so we can check what one user can do to another of the same role and what each role can do to the others. We ask for test accounts and, where you have it, a staging environment; if only production is available we agree safe testing windows. Source-assisted testing is available if you want us to review code alongside the running application.
What you get
A named consultant with a UK Cyber Security Council professional title, who scoped the work and delivers it.
A report within 5 working days: executive summary, technical summary, and observation, impact and remediation for every finding.
Immediate notification of critical and high-risk issues, once we have verified them.
Free retesting: one day for every five days of consultancy, within 90 days of the report.
A walkthrough call with the consultant for your team, on request, at no extra cost.
Frequently asked questions
Do you test against the OWASP Top 10?
Yes, and beyond it. The OWASP Top 10 is a list of categories, not a test plan. Our testing follows the OWASP Web Security Testing Guide and adds manual business-logic and access-control testing, which is where most serious findings are.
Should we test in production or staging?
Staging if it is a faithful copy; production if it is not. Testing in production is common and safe with agreed windows and rules, and it is the only way to be sure the deployed configuration is what you think it is.
How long does a web application test take?
Typically 3 to 10 days depending on the size of the application and the number of roles. We tell you at scoping.
Ready to scope a test?
Book a call. Our sales team will set it up and handle the proposal; an active penetration tester agrees the scope with you. No obligation.